SPLK-1003 Configuration Files — All Questions With Answers

Question 1hardmultiple choice

Read the full Configuration Files explanation →

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Question 2easymultiple choice

Read the full Configuration Files explanation →

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Question 3easymultiple choice

Read the full Configuration Files explanation →

Where is the global configuration for Splunk Enterprise stored?

Question 4easymultiple choice

Read the full Configuration Files explanation →

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Question 5mediummultiple choice

Read the full Configuration Files explanation →

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Question 6mediummultiple choice

Read the full Configuration Files explanation →

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

Question 7mediummultiple choice

Read the full Configuration Files explanation →

Which stanza is required in props.conf to identify a sourcetype?

Question 8hardmultiple choice

Read the full Configuration Files explanation →

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

Question 9mediummulti select

Read the full Configuration Files explanation →

Which TWO of the following are valid ways to define field extractions?

Question 10hardmulti select

Read the full Configuration Files explanation →

Which THREE of the following are true regarding the behavior of 'btool'?

Question 11mediummulti select

Read the full Configuration Files explanation →

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Question 12mediummulti select

Read the full Configuration Files explanation →

Which TWO attributes in props.conf are commonly used to handle multiline events?

Question 13hardmulti select

Read the full Configuration Files explanation →

Which THREE of the following are true regarding the configuration precedence of apps?

Question 14mediummultiple choice

Read the full Configuration Files explanation →

An administrator needs to increase the number of concurrent search jobs a search head can run. The current limit is set in $SPLUNK_HOME/etc/system/default/limits.conf. The administrator creates $SPLUNK_HOME/etc/system/local/limits.conf with a higher value but the change does not take effect after restarting Splunk. What should the administrator check first?

Question 15mediummultiple choice

Read the full Configuration Files explanation →

A Splunk administrator deploys a new technical add-on to a search head cluster. The add-on includes a props.conf stanza that sets LINE_BREAKER for a custom sourcetype. After deployment, the administrator runs btool props list --debug and notices that the effective LINE_BREAKER value differs from the one defined in the add-on's default/props.conf. Where should the administrator look FIRST to determine why the add-on's setting is not taking effect?

Question 16hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator wants to configure a universal forwarder to send data to two separate indexers for redundancy. The administrator edits $SPLUNK_HOME/etc/system/local/outputs.conf and defines two [tcpout:group1] and [tcpout:group2] stanzas, then adds [tcpout] with defaultGroup = group1, group2. After restarting, data is only reaching group1. What is the most likely cause?

Question 17hardmultiple choice

Read the full Configuration Files explanation →

A Splunk admin is troubleshooting why a forwarder is not sending data to the indexer. The forwarder's outputs.conf contains a single stanza [tcpout:myindexers] with server = indexer1:9997, indexer2:9997. The admin notices that data is being queued but not sent, and the indexer is reachable. Which configuration file should the admin check to verify that the forwarder is actually using the 'myindexers' target group?

Question 18mediummultiple choice

Read the full Configuration Files explanation →

An administrator needs to ensure that a new sourcetype stanza defined in an app's local directory takes effect over an identically named stanza in another app's default directory. According to Splunk's configuration file precedence, which action will guarantee this outcome?

Question 19hardmulti select

Read the full Configuration Files explanation →

A Splunk administrator is configuring a new indexer to receive data from forwarders. The administrator wants to ensure that the indexer's configuration files are correctly layered so that a custom setting in an app's local directory takes precedence over the same setting in the app's default directory. Which TWO statements accurately describe Splunk's configuration file precedence and merging behavior? (Choose two.)

Question 20mediummultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to change the maximum size of the in-memory queue that holds events before they are written to disk. The administrator wants this change to apply only to the indexer tier and not be overridden by any app. Which file and directory should be edited?

Question 21hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a universal forwarder to monitor a directory containing log files that are rotated daily. The administrator wants to ensure that the forwarder does not re-index files after rotation and that it follows the file's inode. Which setting in inputs.conf should be used to achieve this?

Question 22easymultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to change the default maximum size of the internal audit index to 2GB. The administrator wants this change to apply to all apps and not be overridden by any app-specific settings. Which file should the administrator edit?

Question 23hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring indexer acknowledgement to ensure data durability. They set 'useACK = true' in outputs.conf on the universal forwarders and 'ack = true' in inputs.conf on the indexers. However, some forwarders are not receiving acknowledgements. Which additional configuration is required to enable indexer acknowledgement properly?

Question 24mediummultiple choice

Study the full Python automation breakdown →

An administrator needs to deploy a new Splunk add-on that includes a custom search command written in Python. The add-on's bin directory contains the script, and a commands.conf stanza defines the command. The administrator wants to ensure the custom command is available to all users in the search app without modifying system files. Where should the commands.conf file be placed?

Question 25mediummulti select

Read the full Configuration Files explanation →

An administrator is reviewing configuration file precedence to troubleshoot why a search-time field extraction is not behaving as expected. Which two statements accurately describe how Splunk resolves conflicting settings across configuration files? (Choose two.)

Question 26easymultiple choice

Read the full Configuration Files explanation →

An administrator needs to ensure that a specific Splunk app's configuration settings are not overridden by any other app. The administrator places the app in $SPLUNK_HOME/etc/apps/my_app and wants to confirm that its settings will take precedence over other apps but not over system-level settings. Which configuration precedence order is correct?

Question 27hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is troubleshooting an issue where events from a particular source are not being assigned the expected sourcetype. The administrator suspects a configuration conflict. Which command should be used to determine the effective sourcetype configuration for a specific source, and what information does it provide?

Question 28hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a heavy forwarder to send data to two different indexers using outputs.conf. They want to ensure that if one indexer is unavailable, data is still sent to the other. Which setting in outputs.conf should they configure to achieve this?

Question 29hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a universal forwarder to send data to an indexer. The administrator wants to ensure that the forwarder uses a specific splunkd port and that the connection is encrypted. Which configuration file and settings should be used to achieve this?

Question 30mediummulti select

Read the full Configuration Files explanation →

An administrator is reviewing the configuration precedence for a Splunk deployment. Which two statements accurately describe how configuration files are merged and which take precedence? (Choose two.)

Question 31mediummultiple choice

Read the full Configuration Files explanation →

An admin must apply a setting to all search heads in a distributed deployment. The setting already exists in $SPLUNK_HOME/etc/system/local/server.conf and is overridden by the same stanza in $SPLUNK_HOME/etc/apps/search/local/server.conf. The admin wants the app-level setting to win. Which action will achieve this without editing the system file?

Question 32mediummultiple choice

Read the full Configuration Files explanation →

An administrator has a universal forwarder that should send data only to the indexer with IP 192.168.10.50 on port 9997. The outputs.conf stanza currently reads:

[tcpout:default-autolb-group]

server = 192.168.10.50:9997

After deployment, the forwarder is still sending to an old indexer at 192.168.10.60. Which configuration file is overriding the forwarder's outputs.conf setting?

Question 33hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is creating a custom app that must set the default index for all data sent by a group of universal forwarders to a specific index called security_events. The administrator wants the setting to apply globally to every input on those forwarders without editing each inputs.conf stanza. Which configuration approach achieves this?

Question 34easymultiple choice

Read the full Configuration Files explanation →

An administrator needs to ensure that events from a newly onboarded application are assigned the sourcetype myapp:access rather than the default sourcetype. The data arrives on a universal forwarder that monitors a log file whose path is /opt/myapp/logs/access.log. Which configuration file and stanza should the administrator edit to assign the sourcetype based on the source path?

Question 35mediummulti select

Read the full Configuration Files explanation →

A Splunk administrator is reviewing the configuration of an indexer that has both an app-level props.conf and a system-level props.conf defining settings for the sourcetype access_combined. The administrator wants to determine which settings actually take effect at runtime. Which TWO actions should the administrator take to inspect the merged configuration and identify the source of each setting? (Choose two.)

Question 36mediummultiple choice

Read the full Configuration Files explanation →

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Question 37mediummultiple choice

Read the full Configuration Files explanation →

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Question 38easymultiple choice

Read the full Configuration Files explanation →

Which configuration file is used to define index-time field extractions and line-breaking rules?

Question 39mediummultiple choice

Read the full Configuration Files explanation →

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

Question 40hardmultiple choice

Read the full Configuration Files explanation →

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Question 41mediummultiple choice

Review the full routing breakdown →

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Question 42hardmultiple choice

Read the full Configuration Files explanation →

How does Splunk handle configuration files that are missing a required attribute?

Question 43mediummultiple choice

Review the full routing breakdown →

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

Question 44hardmultiple choice

Read the full Configuration Files explanation →

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Question 45mediummultiple choice

Read the full Configuration Files explanation →

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Question 46easymultiple choice

Read the full Configuration Files explanation →

Which file is responsible for defining how data is rotated in an index?

Question 47mediummultiple choice

Read the full Configuration Files explanation →

In props.conf, what does the 'REPORT-' prefix signify?

Question 48hardmultiple choice

Read the full Configuration Files explanation →

What happens if you have a syntax error in a .conf file?

Question 49mediummultiple choice

Read the full Configuration Files explanation →

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

Question 50hardmultiple choice

Read the full Configuration Files explanation →

When using btool, what does the output show by default?

Question 51easymultiple choice

Read the full Configuration Files explanation →

Which command is used to restart the Splunk service after modifying configuration files?

Question 52hardmulti select

Read the full Configuration Files explanation →

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Question 53mediummulti select

Read the full Configuration Files explanation →

Which TWO of the following are true about 'local' versus 'default' directories?

Question 54mediummulti select

Read the full Configuration Files explanation →

Which TWO of the following are valid stanza types found in indexes.conf?

Question 55hardmulti select

Read the full Configuration Files explanation →

Which THREE of the following represent true statements about the 'transforms.conf' file?

Question 56easymulti select

Read the full Configuration Files explanation →

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

Question 57mediummultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to ensure that events from a custom sourcetype named 'myapp:log' are timestamped using the format '%Y-%m-%d %H:%M:%S.%3N' and that the timezone is set to UTC. The sourcetype is defined in an app named 'myapp' located at $SPLUNK_HOME/etc/apps/myapp. The administrator wants this configuration to apply only to this app and not affect other apps. Which configuration file and stanza should be edited?

Question 58easymultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to ensure that a specific sourcetype is assigned to data coming from a particular source path. The administrator wants to define the sourcetype at the forwarder before data leaves the host. Which configuration file should be edited on the universal forwarder?

Question 59hardmultiple choice

Read the full Configuration Files explanation →

An administrator is troubleshooting why a custom field extraction defined in props.conf is not being applied to events. The extraction uses a REPORT-class stanza that references a transform in transforms.conf. After running btool props list --debug, the administrator sees the REPORT setting is active. What is the next most likely configuration issue to investigate?

Question 60hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is troubleshooting why a newly created sourcetype is not being assigned to incoming data from a Universal Forwarder. The administrator suspects a configuration conflict. Which command should be used to determine the effective configuration and the file that is providing the sourcetype definition?

Question 61mediummulti select

Read the full Configuration Files explanation →

A Splunk administrator is configuring a new index and needs to ensure that data is retained for exactly 90 days and then frozen. The administrator also wants to limit the index size to 500 GB. Which TWO settings in indexes.conf must be configured to achieve these requirements? (Choose two.)

Question 62easymultiple choice

Read the full Configuration Files explanation →

A junior administrator wants to change the default maximum size of the internal index (_internal) to prevent it from consuming too much disk space. Which configuration file and stanza should they edit?

Question 63hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a new forwarder to send data to an indexer. The administrator wants to ensure that the forwarder uses a specific port and that the connection is encrypted. Which file should be edited to set the default target group and enable SSL, and what is the correct stanza name?

Question 64mediummultiple choice

Read the full Configuration Files explanation →

An administrator needs to configure a Splunk indexer to retain data for 90 days and then delete it. The administrator also wants to ensure that the index does not exceed 500 GB in size. Which configuration file and settings should be used to achieve this?

Question 65hardmultiple choice

Read the full Configuration Files explanation →

A Splunk admin needs to ensure that a custom sourcetype is recognized by all indexers in a distributed environment. The sourcetype definition exists in $SPLUNK_HOME/etc/system/local/props.conf on the search head. Indexers are not recognizing the sourcetype. What is the most likely cause?

Question 66easymultiple choice

Read the full Configuration Files explanation →

A Splunk admin is reviewing an inputs.conf file and notices a stanza with the attribute 'disabled = 1'. What does this attribute accomplish in this context?

Question 67hardmulti select

Read the full Configuration Files explanation →

A Splunk admin is troubleshooting why a search returns no results for a specific index. The admin suspects a configuration precedence issue involving index definitions in multiple apps. Which TWO actions would help identify which configuration file is actually being used for the index definition? (Choose two.)

Question 68mediummultiple choice

Read the full Configuration Files explanation →

An admin needs to change the default retention period for an index without affecting other indexes. The change should persist across restarts. Which configuration file should be edited?

Question 69hardmultiple choice

Read the full Configuration Files explanation →

An administrator is deploying a new index called metrics_archive on an indexer cluster. The administrator creates the index stanza in indexes.conf and places the file in etc/system/local on the cluster manager. After the bundle is pushed, searches against metrics_archive on the peer nodes fail with an error that the index does not exist. Which is the most likely cause?

Question 1hardmultiple choice

Read the full Configuration Files explanation →

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Question 2easymultiple choice

Read the full Configuration Files explanation →

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Question 3easymultiple choice

Read the full Configuration Files explanation →

Where is the global configuration for Splunk Enterprise stored?

Question 4easymultiple choice

Read the full Configuration Files explanation →

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Question 5mediummultiple choice

Read the full Configuration Files explanation →

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Question 6mediummultiple choice

Read the full Configuration Files explanation →

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

Question 7mediummultiple choice

Read the full Configuration Files explanation →

Which stanza is required in props.conf to identify a sourcetype?

Question 8hardmultiple choice

Read the full Configuration Files explanation →

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

Question 9mediummulti select

Read the full Configuration Files explanation →

Which TWO of the following are valid ways to define field extractions?

Question 10hardmulti select

Read the full Configuration Files explanation →

Which THREE of the following are true regarding the behavior of 'btool'?

Question 11mediummulti select

Read the full Configuration Files explanation →

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Question 12mediummulti select

Read the full Configuration Files explanation →

Which TWO attributes in props.conf are commonly used to handle multiline events?

Question 13hardmulti select

Read the full Configuration Files explanation →

Which THREE of the following are true regarding the configuration precedence of apps?

Question 14mediummultiple choice

Read the full Configuration Files explanation →

An administrator needs to increase the number of concurrent search jobs a search head can run. The current limit is set in $SPLUNK_HOME/etc/system/default/limits.conf. The administrator creates $SPLUNK_HOME/etc/system/local/limits.conf with a higher value but the change does not take effect after restarting Splunk. What should the administrator check first?

Question 15mediummultiple choice

Read the full Configuration Files explanation →

A Splunk administrator deploys a new technical add-on to a search head cluster. The add-on includes a props.conf stanza that sets LINE_BREAKER for a custom sourcetype. After deployment, the administrator runs btool props list --debug and notices that the effective LINE_BREAKER value differs from the one defined in the add-on's default/props.conf. Where should the administrator look FIRST to determine why the add-on's setting is not taking effect?

Question 16hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator wants to configure a universal forwarder to send data to two separate indexers for redundancy. The administrator edits $SPLUNK_HOME/etc/system/local/outputs.conf and defines two [tcpout:group1] and [tcpout:group2] stanzas, then adds [tcpout] with defaultGroup = group1, group2. After restarting, data is only reaching group1. What is the most likely cause?

Question 17hardmultiple choice

Read the full Configuration Files explanation →

A Splunk admin is troubleshooting why a forwarder is not sending data to the indexer. The forwarder's outputs.conf contains a single stanza [tcpout:myindexers] with server = indexer1:9997, indexer2:9997. The admin notices that data is being queued but not sent, and the indexer is reachable. Which configuration file should the admin check to verify that the forwarder is actually using the 'myindexers' target group?

Question 18mediummultiple choice

Read the full Configuration Files explanation →

An administrator needs to ensure that a new sourcetype stanza defined in an app's local directory takes effect over an identically named stanza in another app's default directory. According to Splunk's configuration file precedence, which action will guarantee this outcome?

Question 19hardmulti select

Read the full Configuration Files explanation →

A Splunk administrator is configuring a new indexer to receive data from forwarders. The administrator wants to ensure that the indexer's configuration files are correctly layered so that a custom setting in an app's local directory takes precedence over the same setting in the app's default directory. Which TWO statements accurately describe Splunk's configuration file precedence and merging behavior? (Choose two.)

Question 20mediummultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to change the maximum size of the in-memory queue that holds events before they are written to disk. The administrator wants this change to apply only to the indexer tier and not be overridden by any app. Which file and directory should be edited?

Question 21hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a universal forwarder to monitor a directory containing log files that are rotated daily. The administrator wants to ensure that the forwarder does not re-index files after rotation and that it follows the file's inode. Which setting in inputs.conf should be used to achieve this?

Question 22easymultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to change the default maximum size of the internal audit index to 2GB. The administrator wants this change to apply to all apps and not be overridden by any app-specific settings. Which file should the administrator edit?

Question 23hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring indexer acknowledgement to ensure data durability. They set 'useACK = true' in outputs.conf on the universal forwarders and 'ack = true' in inputs.conf on the indexers. However, some forwarders are not receiving acknowledgements. Which additional configuration is required to enable indexer acknowledgement properly?

Question 24mediummultiple choice

Study the full Python automation breakdown →

An administrator needs to deploy a new Splunk add-on that includes a custom search command written in Python. The add-on's bin directory contains the script, and a commands.conf stanza defines the command. The administrator wants to ensure the custom command is available to all users in the search app without modifying system files. Where should the commands.conf file be placed?

Question 25mediummulti select

Read the full Configuration Files explanation →

An administrator is reviewing configuration file precedence to troubleshoot why a search-time field extraction is not behaving as expected. Which two statements accurately describe how Splunk resolves conflicting settings across configuration files? (Choose two.)

Question 26easymultiple choice

Read the full Configuration Files explanation →

An administrator needs to ensure that a specific Splunk app's configuration settings are not overridden by any other app. The administrator places the app in $SPLUNK_HOME/etc/apps/my_app and wants to confirm that its settings will take precedence over other apps but not over system-level settings. Which configuration precedence order is correct?

Question 27hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is troubleshooting an issue where events from a particular source are not being assigned the expected sourcetype. The administrator suspects a configuration conflict. Which command should be used to determine the effective sourcetype configuration for a specific source, and what information does it provide?

Question 28hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a heavy forwarder to send data to two different indexers using outputs.conf. They want to ensure that if one indexer is unavailable, data is still sent to the other. Which setting in outputs.conf should they configure to achieve this?

Question 29hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a universal forwarder to send data to an indexer. The administrator wants to ensure that the forwarder uses a specific splunkd port and that the connection is encrypted. Which configuration file and settings should be used to achieve this?

Question 30mediummulti select

Read the full Configuration Files explanation →

An administrator is reviewing the configuration precedence for a Splunk deployment. Which two statements accurately describe how configuration files are merged and which take precedence? (Choose two.)

Question 31mediummultiple choice

Read the full Configuration Files explanation →

An admin must apply a setting to all search heads in a distributed deployment. The setting already exists in $SPLUNK_HOME/etc/system/local/server.conf and is overridden by the same stanza in $SPLUNK_HOME/etc/apps/search/local/server.conf. The admin wants the app-level setting to win. Which action will achieve this without editing the system file?

Question 32mediummultiple choice

Read the full Configuration Files explanation →

An administrator has a universal forwarder that should send data only to the indexer with IP 192.168.10.50 on port 9997. The outputs.conf stanza currently reads:

[tcpout:default-autolb-group]

server = 192.168.10.50:9997

After deployment, the forwarder is still sending to an old indexer at 192.168.10.60. Which configuration file is overriding the forwarder's outputs.conf setting?

Question 33hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is creating a custom app that must set the default index for all data sent by a group of universal forwarders to a specific index called security_events. The administrator wants the setting to apply globally to every input on those forwarders without editing each inputs.conf stanza. Which configuration approach achieves this?

Question 34easymultiple choice

Read the full Configuration Files explanation →

An administrator needs to ensure that events from a newly onboarded application are assigned the sourcetype myapp:access rather than the default sourcetype. The data arrives on a universal forwarder that monitors a log file whose path is /opt/myapp/logs/access.log. Which configuration file and stanza should the administrator edit to assign the sourcetype based on the source path?

Question 35mediummulti select

Read the full Configuration Files explanation →

A Splunk administrator is reviewing the configuration of an indexer that has both an app-level props.conf and a system-level props.conf defining settings for the sourcetype access_combined. The administrator wants to determine which settings actually take effect at runtime. Which TWO actions should the administrator take to inspect the merged configuration and identify the source of each setting? (Choose two.)

Question 36mediummultiple choice

Read the full Configuration Files explanation →

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Question 37mediummultiple choice

Read the full Configuration Files explanation →

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Question 38easymultiple choice

Read the full Configuration Files explanation →

Which configuration file is used to define index-time field extractions and line-breaking rules?

Question 39mediummultiple choice

Read the full Configuration Files explanation →

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

Question 40hardmultiple choice

Read the full Configuration Files explanation →

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Question 41mediummultiple choice

Review the full routing breakdown →

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Question 42hardmultiple choice

Read the full Configuration Files explanation →

How does Splunk handle configuration files that are missing a required attribute?

Question 43mediummultiple choice

Review the full routing breakdown →

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

Question 44hardmultiple choice

Read the full Configuration Files explanation →

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Question 45mediummultiple choice

Read the full Configuration Files explanation →

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Question 46easymultiple choice

Read the full Configuration Files explanation →

Which file is responsible for defining how data is rotated in an index?

Question 47mediummultiple choice

Read the full Configuration Files explanation →

In props.conf, what does the 'REPORT-' prefix signify?

Question 48hardmultiple choice

Read the full Configuration Files explanation →

What happens if you have a syntax error in a .conf file?

Question 49mediummultiple choice

Read the full Configuration Files explanation →

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

Question 50hardmultiple choice

Read the full Configuration Files explanation →

When using btool, what does the output show by default?

Question 51easymultiple choice

Read the full Configuration Files explanation →

Which command is used to restart the Splunk service after modifying configuration files?

Question 52hardmulti select

Read the full Configuration Files explanation →

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Question 53mediummulti select

Read the full Configuration Files explanation →

Which TWO of the following are true about 'local' versus 'default' directories?

Question 54mediummulti select

Read the full Configuration Files explanation →

Which TWO of the following are valid stanza types found in indexes.conf?

Question 55hardmulti select

Read the full Configuration Files explanation →

Which THREE of the following represent true statements about the 'transforms.conf' file?

Question 56easymulti select

Read the full Configuration Files explanation →

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

Question 57mediummultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to ensure that events from a custom sourcetype named 'myapp:log' are timestamped using the format '%Y-%m-%d %H:%M:%S.%3N' and that the timezone is set to UTC. The sourcetype is defined in an app named 'myapp' located at $SPLUNK_HOME/etc/apps/myapp. The administrator wants this configuration to apply only to this app and not affect other apps. Which configuration file and stanza should be edited?

Question 58easymultiple choice

Read the full Configuration Files explanation →

A Splunk administrator needs to ensure that a specific sourcetype is assigned to data coming from a particular source path. The administrator wants to define the sourcetype at the forwarder before data leaves the host. Which configuration file should be edited on the universal forwarder?

Question 59hardmultiple choice

Read the full Configuration Files explanation →

An administrator is troubleshooting why a custom field extraction defined in props.conf is not being applied to events. The extraction uses a REPORT-class stanza that references a transform in transforms.conf. After running btool props list --debug, the administrator sees the REPORT setting is active. What is the next most likely configuration issue to investigate?

Question 60hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is troubleshooting why a newly created sourcetype is not being assigned to incoming data from a Universal Forwarder. The administrator suspects a configuration conflict. Which command should be used to determine the effective configuration and the file that is providing the sourcetype definition?

Question 61mediummulti select

Read the full Configuration Files explanation →

A Splunk administrator is configuring a new index and needs to ensure that data is retained for exactly 90 days and then frozen. The administrator also wants to limit the index size to 500 GB. Which TWO settings in indexes.conf must be configured to achieve these requirements? (Choose two.)

Question 62easymultiple choice

Read the full Configuration Files explanation →

A junior administrator wants to change the default maximum size of the internal index (_internal) to prevent it from consuming too much disk space. Which configuration file and stanza should they edit?

Question 63hardmultiple choice

Read the full Configuration Files explanation →

A Splunk administrator is configuring a new forwarder to send data to an indexer. The administrator wants to ensure that the forwarder uses a specific port and that the connection is encrypted. Which file should be edited to set the default target group and enable SSL, and what is the correct stanza name?

Question 64mediummultiple choice

Read the full Configuration Files explanation →

An administrator needs to configure a Splunk indexer to retain data for 90 days and then delete it. The administrator also wants to ensure that the index does not exceed 500 GB in size. Which configuration file and settings should be used to achieve this?

Question 65hardmultiple choice

Read the full Configuration Files explanation →

A Splunk admin needs to ensure that a custom sourcetype is recognized by all indexers in a distributed environment. The sourcetype definition exists in $SPLUNK_HOME/etc/system/local/props.conf on the search head. Indexers are not recognizing the sourcetype. What is the most likely cause?

Question 66easymultiple choice

Read the full Configuration Files explanation →

A Splunk admin is reviewing an inputs.conf file and notices a stanza with the attribute 'disabled = 1'. What does this attribute accomplish in this context?

Question 67hardmulti select

Read the full Configuration Files explanation →

A Splunk admin is troubleshooting why a search returns no results for a specific index. The admin suspects a configuration precedence issue involving index definitions in multiple apps. Which TWO actions would help identify which configuration file is actually being used for the index definition? (Choose two.)

Question 68mediummultiple choice

Read the full Configuration Files explanation →

An admin needs to change the default retention period for an index without affecting other indexes. The change should persist across restarts. Which configuration file should be edited?

Question 69hardmultiple choice

Read the full Configuration Files explanation →

An administrator is deploying a new index called metrics_archive on an indexer cluster. The administrator creates the index stanza in indexes.conf and places the file in etc/system/local on the cluster manager. After the bundle is pushed, searches against metrics_archive on the peer nodes fail with an error that the index does not exist. Which is the most likely cause?