SPLK-1003 Configuration Files — 20 Questions

Question 1

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Accepted Answer

It prevents the input from running. The disabled attribute is used to stop an input from running without deleting the configuration.

Answer

It errors out if the input is not found

Answer

It deletes the input

Answer

It hides the input from the UI

Question 2

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Accepted Answer

The file sorted alphabetically by name. When precedence is tied, Splunk uses a deterministic method based on the filename, sorting alphabetically.

Answer

The file with the largest size

Answer

It randomly chooses one

Answer

The file created most recently

Question 3

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Accepted Answer

The app/local value. App-level local directory configurations override system-level local configurations.

Answer

The system/local value

Answer

The configuration with the most recent timestamp

Answer

The configuration alphabetically first

Question 4

Which configuration file is used to define index-time field extractions and line-breaking rules?

Accepted Answer

props.conf. props.conf is the primary file for configuring how data is parsed, including line breaking and field extractions.

Answer

indexes.conf

Answer

transforms.conf

Answer

inputs.conf

Question 5

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

Accepted Answer

$SPLUNK_HOME/etc/apps/app_name/local/. Best practices dictate that configurations should be overridden in the 'local' directory to prevent loss during updates.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/users/admin/

Answer

$SPLUNK_HOME/etc/apps/app_name/default/

Question 6

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 7

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Accepted Answer

transforms.conf. transforms.conf is where the regex logic resides, while props.conf references the transform.

Answer

indexes.conf

Answer

props.conf

Answer

inputs.conf

Question 8

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Accepted Answer

splunk cmd btool props list --debug. splunk btool is the standard CLI utility to show the merged configuration files for a specific context.

Answer

splunk show-config

Answer

splunk edit props

Answer

splunk list configs

Question 9

Where is the global configuration for Splunk Enterprise stored?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. $SPLUNK_HOME/etc/system/local is the location for global, system-wide configuration overrides.

Answer

$SPLUNK_HOME/etc/users/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/

Question 10

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Accepted Answer

inputs.conf. inputs.conf is the standard file for configuring data inputs like TCP ports.

Answer

outputs.conf

Answer

props.conf

Answer

server.conf

Question 11

How does Splunk handle configuration files that are missing a required attribute?

Accepted Answer

The engine ignores the attribute and uses defaults. Splunk generally uses default values if an attribute is omitted, provided the stanza itself is valid.

Answer

The Splunk service fails to start

Answer

The file is marked as corrupted

Answer

The entire file is ignored

Question 12

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

Accepted Answer

It invokes a named transform from transforms.conf. It instructs Splunk to process the data using a specific transform defined in transforms.conf.

Answer

It routes the data to a specific app

Answer

It triggers an alert

Answer

It changes the sourcetype

Question 13

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Accepted Answer

--show-files. The --show-files flag lists the file path for each setting returned by btool.

Answer

--list-files

Answer

--debug

Answer

--source

Question 14

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 15

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

Accepted Answer

[tcpout]. The [tcpout] stanza is used in outputs.conf to define forwarding destinations.

Answer

[index]

Answer

[forwarder]

Answer

[indexer]

Question 16

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Accepted Answer

To specify which field the regex is applied to. SOURCE_KEY allows you to specify a different field (or the whole raw event) to apply the regex to, instead of the default '_raw'.

Answer

To specify the index

Answer

To define the sourcetype

Answer

To set the time format

Question 17

Which file is responsible for defining how data is rotated in an index?

Accepted Answer

indexes.conf. indexes.conf contains settings like maxDataSize and maxHotSpanSecs which define data rotation.

Answer

inputs.conf

Answer

props.conf

Answer

server.conf

Question 18

Which stanza is required in props.conf to identify a sourcetype?

Accepted Answer

[sourcetype]. The sourcetype stanza is defined by the name enclosed in brackets, e.g., [my_sourcetype].

Answer

[default]

Answer

sourcetype = name

Answer

[source::name]

Question 19

In props.conf, what does the 'REPORT-' prefix signify?

Accepted Answer

It defines a search-time extraction. REPORT- is used to associate a report-time extraction (often defined in transforms.conf) with a sourcetype.

Answer

It triggers an alert

Answer

It defines an index-time extraction

Answer

It defines a line-breaking rule

Question 20

What happens if you have a syntax error in a .conf file?

Accepted Answer

The configuration will be ignored and a warning logged. Splunk generally skips the malformed stanza or the entire file, depending on the severity, often logging a warning in splunkd.log.

Answer

The system halts immediately

Answer

It is ignored silently

Answer

Splunk will automatically fix the syntax