SPLK-1003 Practice Test 9 — 10 Questions

Question 1

Which command is used to restart the Splunk service after modifying configuration files?

Accepted Answer

splunk restart. 'splunk restart' is the standard command to apply configuration changes by restarting the service.

Answer

splunk stop-start

Answer

splunk refresh

Answer

splunk reload

Question 2

Which THREE of the following represent true statements about the 'transforms.conf' file?

Accepted Answer

It is used to perform data masking or anonymization. transforms.conf is used for complex extractions, routing, and anonymization.

Answer

It is the primary file for setting up TCP inputs

Answer

It is used to define the sourcetype of data

Question 3

If you need to change the logging level of a specific component on a Universal Forwarder, which file should you edit?

Accepted Answer

log-local.cfg. log-local.cfg (or log.cfg) controls the granularity of internal Splunk logging.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 4

An administrator needs to move the License Master from one server to another. What is the most critical step?

Accepted Answer

Updating the Master URI on all license slaves.. Moving the license master requires transferring the license keys and re-pointing all slaves to the new master URI.

Answer

Reinstalling Splunk on all indexers.

Answer

Changing the license key files on the indexers.

Answer

Deleting the indexer clusters.

Question 5

Which TWO of the following are valid ways to resolve a license violation?

Accepted Answer

Add a new license key with higher capacity.. A violation can be resolved by increasing the quota via a new key or reducing the data ingestion volume.

Answer

Delete the license pool.

Answer

Restart the license master.

Answer

Reinstall Splunk on the indexers.

Question 6

An administrator needs to change the default maximum size of an index. Which file should be modified?

Accepted Answer

indexes.conf. indexes.conf is the authoritative file for index settings including 'maxTotalDataSizeMB'.

Answer

server.conf

Answer

props.conf

Answer

limits.conf

Question 7

Which TWO of the following are true regarding the Deployment Server?

Accepted Answer

It manages configurations for deployment clients.. The DS distributes apps to deployment clients and keeps them in sync.

Answer

It can only manage forwarders on the same subnet.

Answer

It is a required component for all Splunk deployments.

Answer

It is responsible for indexing raw logs.

Question 8

Which stanza is required in props.conf to identify a sourcetype?

Accepted Answer

[sourcetype]. The sourcetype stanza is defined by the name enclosed in brackets, e.g., [my_sourcetype].

Answer

[default]

Answer

sourcetype = name

Answer

[source::name]

Question 9

What is the primary function of the Deployment Server?

Accepted Answer

Centralized management of configuration files. The Deployment Server acts as a central repository for managing configurations and apps across forwarders.

Answer

Indexing data

Answer

Parsing data

Answer

Performing searches

Question 10

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Accepted Answer

props.conf. This setting is defined in props.conf under the specific sourcetype stanza.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf