SPLK-1003 Practice Test 8 — 10 Questions

Question 1

You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?

Accepted Answer

props.conf and transforms.conf. To filter sensitive data on a Heavy Forwarder before it reaches the indexer, you modify props.conf and transforms.conf. props.conf defines the stanza and references a transform, while transforms.conf contains the regex-based rules (e.g., REGEX and DEST_KEY or FORMAT) that drop or mask events/fields. This combination enables data filtering at the parsing stage on the heavy forwarder.

Answer

outputs.conf

Answer

server.conf

Answer

inputs.conf

Question 2

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 3

Which file in the index directory contains the bucket's metadata?

Accepted Answer

bucket.meta. The bucket.meta file in a Splunk index bucket directory contains metadata about the bucket, including its state (hot, warm, cold, frozen), time range, and other properties. It is essential for the indexer to manage bucket lifecycle and searchability.

Answer

rawdata

Answer

journal.gz

Answer

index.conf

Question 4

You have configured a serverclass in serverclass.conf on the Deployment Server. Which action is required to ensure that the forwarders receive the new configuration?

Accepted Answer

Run the reload deploy-server command. After updating configuration files on the Deployment Server, you must either wait for the poll interval or trigger a reload of the deployment server configuration.

Answer

...

Answer

Update outputs.conf on the client

Answer

Restart the forwarder service

Answer

Modify the indexer's inputs.conf

Question 5

When configuring an index, which setting determines the directory where 'cold' buckets are stored?

Accepted Answer

coldPath. The coldPath setting in indexes.conf specifies the directory where cold buckets are stored. As buckets age out of the hot/warm phase, they are rolled to cold storage, and coldPath defines that location. This allows administrators to place cold data on cheaper, slower disks.

Answer

thawedPath

Answer

homePath

Answer

frozenPath

Question 6

Which THREE of the following items are considered Knowledge Objects in Splunk?

Accepted Answer

Saved searches.. In Splunk, Knowledge Objects are user-created configurations that enrich, normalize, and present machine data, and Saved searches (C) qualify because they are reusable search definitions stored in Splunk that can be shared, scheduled, and used to drive other knowledge objects. Dashboards (D) are also Knowledge Objects since they are XML/JSON-defined panels and visualizations built from searches and stored in Splunk for reuse and sharing. Alerts (E) are Knowledge Objects as well, because they are saved search definitions with trigger conditions and actions that fire when results meet specified thresholds. Network cables (A) and hard drives (B) are physical hardware components, not Splunk-created knowledge artifacts, so they are not Knowledge Objects.

Answer

Network cables.

Answer

Hard drives.

Question 7

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf is correct because it defines the data inputs (monitor, TCP/UDP, scripted, etc.) that determine what data gets ingested into the indexer, including stanzas like [monitor:///var/log] with settings such as disabled, sourcetype, and index. props.conf is correct because it controls how the indexer parses and processes incoming events, setting sourcetype, line-breaking (LINE_BREAKER, SHOULD_LINEMERGE), timestamp recognition (TIME_PREFIX, TIME_FORMAT), and field extractions at index time. transforms.conf is correct because it defines the regex-based transformations and field extractions (REGEX, FORMAT, DEST_KEY) referenced by props.conf and inputs.conf, enabling routing, masking, and parsing of ingested data. server.conf is not among the three because it governs server-level settings like clustering, licensing, and general Splunk instance behavior rather than ingestion or parsing. indexes.conf is not among the three because it defines index storage properties such as path, maxDataSize, and retention, not how data is ingested or parsed.

Answer

server.conf

Answer

indexes.conf

Question 8

Which THREE factors can impact the performance of a Universal Forwarder?

Accepted Answer

Network bandwidth limits. Network bandwidth limits (B) directly affect a Universal Forwarder because it must transmit event data to the indexer over TCP port 9997, and constrained throughput causes queuing and delayed delivery. The number of active file monitors (D) impacts performance since each monitored file consumes resources for file tracking, checksumming, and reading, and many monitors increase CPU and memory usage. Disk I/O contention (E) matters because the forwarder continuously reads from monitored files and writes to its fishbucket and persistent queues, so slow or contended disks throttle ingestion. Browser type (A) is irrelevant because the Universal Forwarder has no web UI and is configured via CLI or deployment apps, and the number of logged-in users (C) does not affect the forwarder, which runs as a background service independent of interactive user sessions.

Answer

Browser type used for access

Answer

The number of users logged in

Question 9

Which of the following is a primary reason to choose a Heavy Forwarder over a Universal Forwarder?

Accepted Answer

Ability to perform index-time parsing. A primary reason to choose a Heavy Forwarder over a Universal Forwarder is the ability to perform index-time parsing. Heavy Forwarders can parse, filter, and transform data (using props.conf/transforms.conf) before forwarding, whereas Universal Forwarders primarily forward raw data with minimal processing. This makes Heavy Forwarders suitable for data reduction and routing.

Answer

Easier installation

Answer

Native indexing capability

Answer

Lower CPU utilization

Question 10

An administrator needs to move the License Master from one server to another. What is the most critical step?

Accepted Answer

Updating the Master URI on all license slaves.. When moving the License Master to a new server, every license slave (indexer, search head, forwarder in some topologies) must be pointed at the new License Master URI via the [license] stanza's master_uri setting in server.conf. Without this update, slaves continue trying to reach the old master, causing license warnings, search failures, or a complete loss of licensing enforcement. The new master must also be configured with the same license keys and pool assignments.

Answer

Reinstalling Splunk on all indexers.

Answer

Changing the license key files on the indexers.

Answer

Deleting the indexer clusters.