SPLK-1003 Configuration Files Practice Test 3 — 15 Questions

Question 1

An admin must apply a setting to all search heads in a distributed deployment. The setting already exists in $SPLUNK_HOME/etc/system/local/server.conf and is overridden by the same stanza in $SPLUNK_HOME/etc/apps/search/local/server.conf. The admin wants the app-level setting to win. Which action will achieve this without editing the system file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an app at a higher precedence layer, such as a user-level or app-specific override that ranks above system/local for the same setting.. Configuration precedence in Splunk Enterprise determines which value wins when the same setting appears in multiple files. System/local is relatively high, but more specific user or app contexts can outrank it. The admin can achieve the goal by placing the override in a higher-precedence context instead of editing system/local, which the scenario forbids. This leverages precedence mechanics rather than destructive edits.

Answer

Move the setting to $SPLUNK_HOME/etc/apps/search/default/server.conf.

Answer

Create an app-specific local file at higher precedence, such as $SPLUNK_HOME/etc/apps/search/local/server.conf already is, and verify no system/local override remains.

Answer

Edit $SPLUNK_HOME/etc/system/local/server.conf to remove or comment out the conflicting setting.

Question 2

An administrator has a universal forwarder that should send data only to the indexer with IP 192.168.10.50 on port 9997. The outputs.conf stanza currently reads:

[tcpout:default-autolb-group]
server = 192.168.10.50:9997

After deployment, the forwarder is still sending to an old indexer at 192.168.10.60. Which configuration file is overriding the forwarder's outputs.conf setting?

Accepted Answer

The deployment-apps directory on the deployment server. Configuration precedence for a universal forwarder places app context above system/local when the same stanza appears in both. A deployment server commonly delivers an app containing outputs.conf into etc/apps, and that copy silently overrides a locally edited file. The admin must locate the app on the deployment server, correct the server attribute there, and redeploy so the forwarder receives the updated configuration.

Answer

etc/apps/search/local/outputs.conf

Answer

system/local/outputs.conf

Answer

etc/system/default/outputs.conf

Question 3

A Splunk administrator is creating a custom app that must set the default index for all data sent by a group of universal forwarders to a specific index called security_events. The administrator wants the setting to apply globally to every input on those forwarders without editing each inputs.conf stanza. Which configuration approach achieves this?

Accepted Answer

Create an app with transforms.conf and props.conf that route all events to security_events using a TRANSFORMS stanza.. To send all events from a set of forwarders to one index regardless of input, the administrator must use an index-time transform. A transforms.conf stanza with REGEX matching every event, DEST_KEY set to _MetaData:Index, and FORMAT set to the target index name, referenced from props.conf via TRANSFORMS, accomplishes global routing. Deploying this app through the deployment server keeps the configuration consistent across all forwarders.

Answer

Create an app with props.conf containing a [default] stanza with index = security_events.

Answer

Add index = security_events to a [default] stanza in inputs.conf on each forwarder.

Answer

Set defaultIndex = security_events in server.conf on each forwarder.

Question 4

An administrator needs to ensure that events from a newly onboarded application are assigned the sourcetype myapp:access rather than the default sourcetype. The data arrives on a universal forwarder that monitors a log file whose path is /opt/myapp/logs/access.log. Which configuration file and stanza should the administrator edit to assign the sourcetype based on the source path?

Accepted Answer

inputs.conf with a [monitor:///opt/myapp/logs/access.log] stanza containing sourcetype = myapp:access. A universal forwarder assigns a sourcetype to monitored files through the sourcetype attribute inside the monitor stanza in inputs.conf. Adding the attribute to the [monitor:///opt/myapp/logs/access.log] stanza causes every event collected from that path to carry the myapp:access sourcetype, which is then preserved through forwarding and indexing. This is the standard input-time approach for path-based sourcetype assignment.

Answer

transforms.conf with a [set_sourcetype] stanza containing SOURCE_KEY = source and FORMAT = myapp:access

Answer

props.conf with a [source::/opt/myapp/logs/access.log] stanza containing sourcetype = myapp:access

Answer

outputs.conf with a [tcpout] stanza containing sourcetype = myapp:access

Question 5

A Splunk administrator is reviewing the configuration of an indexer that has both an app-level props.conf and a system-level props.conf defining settings for the sourcetype access_combined. The administrator wants to determine which settings actually take effect at runtime. Which TWO actions should the administrator take to inspect the merged configuration and identify the source of each setting? (Choose two.)

Accepted Answer

Run splunk show config props to print the runtime configuration to the terminal.. btool and the splunk show config command both resolve configuration precedence and report the effective values for a stanza. Using btool props list with --debug additionally reveals the file and line number behind each value, while splunk show config props prints the merged configuration from the running process. Together they let the administrator confirm which settings are active and trace them to their source files.

Answer

Restart the indexer and review the splunkd.log for a list of all props.conf stanzas loaded.

Answer

Search the _internal index for messages containing the sourcetype name to identify the winning stanza.

Answer

Open the Settings > Configuration > props page in Splunk Web to view the merged stanza.

Question 6

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Accepted Answer

It prevents the input from running. The 'disabled=1' attribute in an inputs.conf stanza tells splunkd to skip loading and running that input. The stanza remains in the configuration file (so it can be re-enabled later by setting disabled=0 or removing the attribute), but the input does not execute — no data is collected or forwarded from that source.

Answer

It errors out if the input is not found

Answer

It deletes the input

Answer

It hides the input from the UI

Question 7

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Accepted Answer

The app/local value. Splunk's configuration file precedence is determined by the directory location, not timestamps or alphabetical order. The order from lowest to highest precedence is: system/default, app/default, system/local, app/local. Since app/local has higher precedence than system/local, the setting in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf overrides the one in $SPLUNK_HOME/etc/system/local/inputs.conf.

Answer

The system/local value

Answer

The configuration with the most recent timestamp

Answer

The configuration alphabetically first

Question 8

Which configuration file is used to define index-time field extractions and line-breaking rules?

Accepted Answer

props.conf. props.conf is the Splunk configuration file that controls how the indexer processes incoming data at index time, including line-breaking rules (LINE_BREAKER, SHOULD_LINEMERGE), timestamp recognition, and field extractions via TRANSFORMS or REPORT. It is specifically designed for parsing and indexing-time transformations, making it the correct choice for defining index-time field extractions and line-breaking rules.

Answer

indexes.conf

Answer

transforms.conf

Answer

inputs.conf

Question 9

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

Accepted Answer

$SPLUNK_HOME/etc/apps/app_name/local/. Best practices dictate that configurations should be overridden in the 'local' directory to prevent loss during updates.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/users/admin/

Answer

$SPLUNK_HOME/etc/apps/app_name/default/

Question 10

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 11

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Accepted Answer

transforms.conf. In Splunk, regex-based routing to different indexes is achieved by defining a transform with a REGEX and a DEST_KEY that points to the index metadata field (_MetaData:Index). This transform is defined in transforms.conf. The transform is then referenced from props.conf using a rule class (e.g., TRANSFORMS- = ). Therefore, transforms.conf is the file that must be configured to define the routing regex.

Answer

indexes.conf

Answer

props.conf

Answer

inputs.conf

Question 12

How does Splunk handle configuration files that are missing a required attribute?

Accepted Answer

The engine ignores the attribute and uses defaults. When a Splunk configuration file is missing a required attribute, the engine does not fail or discard the file — it falls back to the default value defined in the underlying spec file (e.g., $SPLUNK_HOME/etc/system/README/*.conf.spec). This allows Splunk to remain resilient to incomplete configurations. The attribute is effectively ignored and the default is applied.

Answer

The Splunk service fails to start

Answer

The file is marked as corrupted

Answer

The entire file is ignored

Question 13

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

Accepted Answer

It invokes a named transform from transforms.conf. TRANSFORMS-routing in props.conf invokes a named transform defined in transforms.conf, which can then route events to a specific index, sourcetype, or drop them. The transform is referenced by its stanza name, and the routing action is defined within that transform (e.g., using DEST_KEY and REGEX). This is the standard mechanism for index routing and event filtering.

Answer

It routes the data to a specific app

Answer

It triggers an alert

Answer

It changes the sourcetype

Question 14

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 15

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Accepted Answer

To specify which field the regex is applied to. SOURCE_KEY allows you to specify a different field (or the whole raw event) to apply the regex to, instead of the default '_raw'.

Answer

To specify the index

Answer

To define the sourcetype

Answer

To set the time format