SPLK-1003 Practice Questions 2 — 50 Questions

Question 1

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 2

Which TWO of the following are valid stanza types found in indexes.conf?

Accepted Answer

[default]. indexes.conf uses index names as stanzas, and [default] for global settings.

Answer

[tcpout]

Answer

[input]

Answer

[source::...]

Question 3

Which TWO settings are required to enable cold-to-frozen archiving?

Accepted Answer

coldToFrozenDir. To enable archiving, you must define the coldToFrozenScript and ensure the path for frozen data exists.

Answer

frozenPath

Answer

maxFrozenSize

Answer

enableArchive = true

Question 4

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 5

Which user interface feature allows you to view the connectivity status of all forwarders reporting to an Indexer?

Accepted Answer

Forwarder Management. The Forwarder Management dashboard provides a high-level view of connected forwarders.

Answer

License Manager

Answer

Data Inputs

Answer

Indexes

Question 6

Which license type does not support license clustering?

Accepted Answer

Free License. The Free license is a standalone, single-instance license and does not support clustering or license pools.

Answer

Enterprise License

Answer

Trial License

Answer

Developer License

Question 7

When setting up a License Master in a distributed environment, what is the recommended practice for the License Master role?

Accepted Answer

Dedicate an instance to act as the License Master.. The License Master should be a dedicated instance (or a primary instance) to ensure license availability and accurate reporting.

Answer

Co-locate it with a Search Head.

Answer

Co-locate it with a heavy forwarder.

Answer

Assign it to a standalone Indexer.

Question 8

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 9

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 10

When using btool, what does the output show by default?

Accepted Answer

The merged configuration of all files. By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Answer

Only the differences from defaults

Answer

The raw file contents

Answer

Only the changes made in /local

Question 11

You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?

Accepted Answer

Define multiple target groups in outputs.conf and use transforms.conf to route.. Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.

Answer

Use inputs.conf to specify the destination indexer.

Answer

Configure the indexer to pull data from the forwarder.

Answer

Use a single outputs.conf with comma-separated values.

Question 12

Which capability is exclusive to a Heavy Forwarder compared to a Universal Forwarder?

Accepted Answer

Parsing data. Heavy Forwarders can perform full parsing, indexing, and routing of data.

Answer

Collecting local files

Answer

Connecting to a Deployment Server

Answer

Forwarding data

Question 13

How does Splunk handle configuration files that are missing a required attribute?

Accepted Answer

The engine ignores the attribute and uses defaults. Splunk generally uses default values if an attribute is omitted, provided the stanza itself is valid.

Answer

The Splunk service fails to start

Answer

The file is marked as corrupted

Answer

The entire file is ignored

Question 14

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf, props.conf, and transforms.conf form the core of data processing.

Answer

server.conf

Answer

indexes.conf

Question 15

Why might an administrator need to use the 'splunk edit licenser-localslave' command?

Accepted Answer

To configure the local instance to be a license slave.. This command allows the local instance to be configured as a license slave if it wasn't during installation.

Answer

To reset the license violation counter.

Answer

To create a new license pool.

Answer

To delete an expired license.

Question 16

What is the maximum number of license violations allowed in a 30-day period before search is blocked?

Accepted Answer

5. Splunk allows 5 violations in a 30-day rolling window before blocking search.

Answer

3

Answer

10

Answer

1

Question 17

What is the default port used by the Splunk Web interface?

Accepted Answer

8000. 8000 is the standard default port for Splunk Web.

Answer

9997

Answer

8089

Answer

443

Question 18

What happens to a user's session if their role is modified while they are logged in?

Accepted Answer

The user must log out and back in for changes to take effect.. Changes to a user's role permissions take effect only upon the next login (or session refresh).

Answer

The changes are applied immediately to their current session.

Answer

The user's session is terminated after 5 minutes.

Answer

The user is forced to log out immediately.

Question 19

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

Accepted Answer

The Splunk Instance.. The Splunk instance itself acts as the Service Provider (SP) in the SAML handshake.

Answer

The browser.

Answer

The Identity Provider (IdP).

Answer

The LDAP Server.

Question 20

When using the 'splunk cmd splunkd bucket-info' tool, what are you primarily investigating?

Accepted Answer

Bucket state and event boundaries.. This tool allows administrators to inspect the properties of individual buckets, such as size, state, and event counts.

Answer

Search performance metrics.

Answer

User authentication logs.

Answer

Indexer license usage.