SPLK-1003 Configuration Files Practice Test 2 — 15 Questions

Question 1

A Splunk administrator wants to configure a universal forwarder to send data to two separate indexers for redundancy. The administrator edits $SPLUNK_HOME/etc/system/local/outputs.conf and defines two [tcpout:group1] and [tcpout:group2] stanzas, then adds [tcpout] with defaultGroup = group1, group2. After restarting, data is only reaching group1. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The defaultGroup setting requires groups to be separated by commas without spaces.. The defaultGroup attribute in the [tcpout] stanza uses a comma-separated list with no spaces. Including a space after the comma causes the second group name to be parsed incorrectly, so the forwarder only sends to the first group. Correcting the syntax to 'group1,group2' allows data to flow to both indexer groups.

Answer

Universal forwarders cannot send to multiple indexer groups simultaneously.

Answer

The forwarder requires the use of a load-balancing scheme such as autoLB in the defaultGroup stanza.

Answer

Each tcpout group must include the indexAndForward = true setting to receive data.

Question 2

A Splunk admin is troubleshooting why a forwarder is not sending data to the indexer. The forwarder's outputs.conf contains a single stanza [tcpout:myindexers] with server = indexer1:9997, indexer2:9997. The admin notices that data is being queued but not sent, and the indexer is reachable. Which configuration file should the admin check to verify that the forwarder is actually using the 'myindexers' target group?

Accepted Answer

$SPLUNK_HOME/etc/system/local/outputs.conf, specifically the [tcpout] stanza's defaultGroup setting. The forwarder uses the defaultGroup setting in the [tcpout] stanza of outputs.conf to determine which target group to send data to. If this setting is missing or incorrect, the forwarder may not send data even if the target group is defined. The admin should verify that defaultGroup is set to 'myindexers' in the appropriate outputs.conf, typically in system/local or an app's local directory.

Answer

$SPLUNK_HOME/etc/system/local/inputs.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/outputs.conf

Answer

$SPLUNK_HOME/etc/system/local/outputs.conf

Question 3

An administrator needs to ensure that a new sourcetype stanza defined in an app's local directory takes effect over an identically named stanza in another app's default directory. According to Splunk's configuration file precedence, which action will guarantee this outcome?

Accepted Answer

Place the stanza in $SPLUNK_HOME/etc/system/local/.. Configuration precedence in Splunk follows a specific order: system local overrides app local, which overrides app default, and system default is lowest. To guarantee that a stanza overrides an identically named one in another app's default, placing it in system/local is the most reliable method because system local has the highest precedence. This ensures the setting is applied regardless of app ordering or other app-level configurations.

Answer

Place the stanza in $SPLUNK_HOME/etc/apps/<app_name>/local/ of an app that is earlier in the app precedence order.

Answer

Place the stanza in $SPLUNK_HOME/etc/apps/<app_name>/default/ of the app with the highest precedence.

Answer

Use btool to merge the configurations and then restart Splunk.

Question 4

A Splunk administrator is configuring a new indexer to receive data from forwarders. The administrator wants to ensure that the indexer's configuration files are correctly layered so that a custom setting in an app's local directory takes precedence over the same setting in the app's default directory. Which TWO statements accurately describe Splunk's configuration file precedence and merging behavior? (Choose two.)

Accepted Answer

Settings in $SPLUNK_HOME/etc/system/local override settings in any app's local directory.. Splunk merges configuration files using a defined precedence order. Within an app, local overrides default. Across the system, system/local overrides all app directories. Understanding these two rules allows an administrator to place custom settings in the correct location so they take effect as intended, while avoiding unintended overrides from higher-precedence files.

Answer

Settings in an app's default directory override settings in another app's local directory.

Answer

Configuration files are merged at the stanza and key level, so a setting not defined in a higher-precedence file is inherited from a lower-precedence file.

Answer

When two apps define the same setting at the same precedence level, the app with the alphabetically first name wins.

Question 5

A Splunk administrator needs to change the maximum size of the in-memory queue that holds events before they are written to disk. The administrator wants this change to apply only to the indexer tier and not be overridden by any app. Which file and directory should be edited?

Accepted Answer

$SPLUNK_HOME/etc/system/local/indexes.conf. Queue sizing for an index is defined by maxMemMB in indexes.conf. To ensure the setting is not overridden by any app, it must be placed in the system/local directory, which has the highest precedence for system-wide configuration. The default directory is reserved for Splunk's internal defaults and should not be modified.

Answer

$SPLUNK_HOME/etc/system/default/inputs.conf

Answer

$SPLUNK_HOME/etc/system/local/server.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/indexes.conf

Question 6

A Splunk administrator is configuring a universal forwarder to monitor a directory containing log files that are rotated daily. The administrator wants to ensure that the forwarder does not re-index files after rotation and that it follows the file's inode. Which setting in inputs.conf should be used to achieve this?

Accepted Answer

crcSalt = . When files are rotated, their inode may change or they may be renamed. The forwarder uses CRC and inode to track files. Setting crcSalt = incorporates the file path into the CRC, so when a file is rotated (e.g., renamed from app.log to app.log.1), the CRC changes, and the forwarder treats it as a new file, reading it from the beginning. This ensures that data is not re-indexed from the original file and that rotated files are correctly processed.

Answer

ignoreOlderThan = 7d

Answer

initCrcLength = 256

Answer

followTail = 0

Question 7

A Splunk administrator needs to change the default maximum size of the internal audit index to 2GB. The administrator wants this change to apply to all apps and not be overridden by any app-specific settings. Which file should the administrator edit?

Accepted Answer

$SPLUNK_HOME/etc/system/local/indexes.conf. To apply a configuration change globally and prevent it from being overridden by app-specific settings, the administrator must use the highest-precedence location: system/local. Editing indexes.conf there ensures the audit index size limit is enforced across all apps and cannot be superseded by app local or default configurations.

Answer

$SPLUNK_HOME/etc/apps/search/local/indexes.conf

Answer

$SPLUNK_HOME/etc/system/default/indexes.conf

Answer

$SPLUNK_HOME/etc/apps/my_custom_app/default/indexes.conf

Question 8

A Splunk administrator is configuring indexer acknowledgement to ensure data durability. They set 'useACK = true' in outputs.conf on the universal forwarders and 'ack = true' in inputs.conf on the indexers. However, some forwarders are not receiving acknowledgements. Which additional configuration is required to enable indexer acknowledgement properly?

Accepted Answer

Ensure the indexers have 'ack = true' in the [splunktcp] stanza of inputs.conf and the forwarders have 'useACK = true' in the [tcpout] stanza of outputs.conf.. Indexer acknowledgement is a feature that ensures data is acknowledged by the indexer before the forwarder discards it. To enable it, the forwarder must have 'useACK = true' in the [tcpout] stanza of outputs.conf, and the indexer must have 'ack = true' in the [splunktcp] stanza of inputs.conf. The administrator already set 'useACK' on forwarders and 'ack' on indexers, but likely in the wrong stanzas. The correct placement is crucial for the feature to function.

Answer

Set 'ack = true' in outputs.conf on the forwarders.

Answer

Restart the indexers and forwarders after setting the parameters.

Answer

Set 'useACK = true' in inputs.conf on the indexers.

Question 9

An administrator needs to deploy a new Splunk add-on that includes a custom search command written in Python. The add-on's bin directory contains the script, and a commands.conf stanza defines the command. The administrator wants to ensure the custom command is available to all users in the search app without modifying system files. Where should the commands.conf file be placed?

Accepted Answer

$SPLUNK_HOME/etc/apps/<addon_name>/local/commands.conf. The correct location is within the add-on's local directory, as this scopes the custom command to the add-on and avoids modifying system files. This adheres to Splunk's configuration precedence and app isolation principles, ensuring the command is available to all users when the app is enabled and shared appropriately.

Answer

$SPLUNK_HOME/etc/system/local/commands.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/commands.conf

Answer

$SPLUNK_HOME/etc/users/<username>/search/local/commands.conf

Question 10

An administrator is reviewing configuration file precedence to troubleshoot why a search-time field extraction is not behaving as expected. Which two statements accurately describe how Splunk resolves conflicting settings across configuration files? (Choose two.)

Accepted Answer

Settings in $SPLUNK_HOME/etc/apps/<app>/default override those in $SPLUNK_HOME/etc/system/default.. Splunk resolves configuration conflicts using a precedence hierarchy: system local > app local > app default > system default. Additionally, within app local and app default, the order of apps matters, with later apps in the precedence order overriding earlier ones. The correct statements reflect that system local overrides app local, and app default overrides system default. These rules are fundamental for troubleshooting why a particular setting is or isn't applied.

Answer

Settings in $SPLUNK_HOME/etc/system/default override those in $SPLUNK_HOME/etc/apps/<app>/local.

Answer

Settings in an app's local directory override those in another app's default directory if the first app appears earlier in the app precedence order.

Answer

If two apps have conflicting settings in their local directories, the app whose name comes first alphabetically wins.

Question 11

An administrator needs to ensure that a specific Splunk app's configuration settings are not overridden by any other app. The administrator places the app in $SPLUNK_HOME/etc/apps/my_app and wants to confirm that its settings will take precedence over other apps but not over system-level settings. Which configuration precedence order is correct?

Accepted Answer

system/local > app/local > app/default > system/default. Splunk's configuration precedence, from highest to lowest, is system/local, app/local, app/default, and system/default. This ensures that system-level customizations override app-level ones, and within an app, local settings override defaults. Placing an app in etc/apps/my_app allows its local settings to take effect without being overridden by other apps, as long as no system/local conflict exists.

Answer

app/default > app/local > system/default > system/local

Answer

system/default > app/default > app/local > system/local

Answer

app/local > system/local > app/default > system/default

Question 12

A Splunk administrator is troubleshooting an issue where events from a particular source are not being assigned the expected sourcetype. The administrator suspects a configuration conflict. Which command should be used to determine the effective sourcetype configuration for a specific source, and what information does it provide?

Accepted Answer

splunk btool props list --debug --sourcetype <sourcetype>. The btool command with the props list subcommand and --debug flag, combined with a sourcetype filter, displays the merged configuration and indicates which file provides each setting. This is the most precise way to identify the effective sourcetype configuration for a given source and resolve conflicts.

Answer

splunk btool props list --debug

Answer

splunk btool props list <sourcetype> --debug

Answer

splunk btool props list --debug | grep <source>

Question 13

A Splunk administrator is configuring a heavy forwarder to send data to two different indexers using outputs.conf. They want to ensure that if one indexer is unavailable, data is still sent to the other. Which setting in outputs.conf should they configure to achieve this?

Accepted Answer

autoLB = true and maxQueueSize set to a non-zero value. In outputs.conf, automatic load balancing is enabled with 'autoLB = true', which distributes data across multiple indexers. To handle indexer failures, the forwarder must be able to queue data when an indexer is down; this is controlled by 'maxQueueSize'. When set to a non-zero value, the forwarder will buffer data and retry, effectively failing over to other available indexers. Thus, the combination of 'autoLB = true' and a non-zero 'maxQueueSize' provides the desired failover capability.

Answer

autoLB = true

Answer

failover = true

Answer

useACK = true

Question 14

A Splunk administrator is configuring a universal forwarder to send data to an indexer. The administrator wants to ensure that the forwarder uses a specific splunkd port and that the connection is encrypted. Which configuration file and settings should be used to achieve this?

Accepted Answer

outputs.conf with [tcpout] stanza, server=indexer:9997, and useSSL=true. outputs.conf on the universal forwarder is the correct file to specify the indexer destination and enable SSL. The [tcpout] stanza with server and useSSL settings achieves the required port and encryption.

Answer

inputs.conf with [splunktcp://9997] stanza and ssl settings

Answer

web.conf with [settings] stanza and mgmtPort

Answer

server.conf with [sslConfig] stanza and sslKeysfile

Question 15

An administrator is reviewing the configuration precedence for a Splunk deployment. Which two statements accurately describe how configuration files are merged and which take precedence? (Choose two.)

Accepted Answer

Settings in $SPLUNK_HOME/etc/apps//local override those in $SPLUNK_HOME/etc/apps//default.. The two correct statements reflect Splunk's configuration precedence: within an app, local overrides default; and user-specific settings override app-level settings. These rules ensure that customizations at more specific levels take effect.

Answer

Settings in $SPLUNK_HOME/etc/apps/<app>/default override those in $SPLUNK_HOME/etc/system/local.

Answer

Settings in $SPLUNK_HOME/etc/system/local override those in $SPLUNK_HOME/etc/apps/<app>/local.

Answer

Settings in $SPLUNK_HOME/etc/system/default override those in $SPLUNK_HOME/etc/system/local.