SPLK-1003 Configuration Files Practice Test 4 — 15 Questions

Question 1

Which file is responsible for defining how data is rotated in an index?

Accepted Answer

indexes.conf. indexes.conf is the configuration file that defines index properties, including data rotation behavior via settings like maxDataSize (which controls bucket size before rolling to a new bucket), frozenTimePeriodInSecs (retention), and maxTotalDataSizeMB (total index size). These settings determine how and when data is rotated, archived, or deleted. This makes indexes.conf the authoritative file for index lifecycle management.

Answer

inputs.conf

Answer

props.conf

Answer

server.conf

Question 2

In props.conf, what does the 'REPORT-' prefix signify?

Accepted Answer

It defines a search-time extraction. In props.conf, the `REPORT-` prefix defines a search-time field extraction that references a transform stanza (typically in transforms.conf) using a regex. It is applied when a search runs against the data, not when the data is indexed. This is why REPORT- extractions can be added or modified without re-indexing existing events.

Answer

It triggers an alert

Answer

It defines an index-time extraction

Answer

It defines a line-breaking rule

Question 3

What happens if you have a syntax error in a .conf file?

Accepted Answer

The configuration will be ignored and a warning logged. When Splunk encounters a syntax error in a .conf file, it does not halt the entire system. Instead, it ignores the malformed configuration stanza and logs a warning to splunkd.log, allowing other valid configurations to continue functioning. This graceful degradation prevents a single typo from taking down the whole instance.

Answer

The system halts immediately

Answer

It is ignored silently

Answer

Splunk will automatically fix the syntax

Question 4

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

Accepted Answer

To specify the start of the timestamp. It specifies the regex pattern to locate the start of the timestamp in an event.

Answer

To set the time format

Answer

To define the timezone

Answer

To truncate the timestamp

Question 5

When using btool, what does the output show by default?

Accepted Answer

The merged configuration of all files. By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Answer

Only the differences from defaults

Answer

The raw file contents

Answer

Only the changes made in /local

Question 6

Which command is used to restart the Splunk service after modifying configuration files?

Accepted Answer

splunk restart. The command 'splunk restart' is used to restart the Splunk service after modifying configuration files. It stops and starts the Splunk process, ensuring that configuration changes are applied. This is the standard CLI method for a full restart.

Answer

splunk stop-start

Answer

splunk refresh

Answer

splunk reload

Question 7

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf is correct because it defines the data inputs (monitor, TCP/UDP, scripted, etc.) that determine what data gets ingested into the indexer, including stanzas like [monitor:///var/log] with settings such as disabled, sourcetype, and index. props.conf is correct because it controls how the indexer parses and processes incoming events, setting sourcetype, line-breaking (LINE_BREAKER, SHOULD_LINEMERGE), timestamp recognition (TIME_PREFIX, TIME_FORMAT), and field extractions at index time. transforms.conf is correct because it defines the regex-based transformations and field extractions (REGEX, FORMAT, DEST_KEY) referenced by props.conf and inputs.conf, enabling routing, masking, and parsing of ingested data. server.conf is not among the three because it governs server-level settings like clustering, licensing, and general Splunk instance behavior rather than ingestion or parsing. indexes.conf is not among the three because it defines index storage properties such as path, maxDataSize, and retention, not how data is ingested or parsed.

Answer

server.conf

Answer

indexes.conf

Question 8

Which TWO of the following are true about 'local' versus 'default' directories?

Accepted Answer

'local' files are preserved during Splunk upgrades. Option A is correct because files placed in a 'local' directory are user- or admin-created customizations that are preserved during a Splunk upgrade, whereas 'default' files are overwritten by the upgrade process. Option D is correct because Splunk's configuration precedence hierarchy gives 'local' higher precedence than 'default', so settings in 'local' override conflicting settings in 'default'. Option B is incorrect because 'default' files ship with Splunk and should not be edited; custom changes belong in 'local' (or an app's local directory) to survive upgrades. Option C is incorrect because 'local' directories can exist in app directories (e.g., $SPLUNK_HOME/etc/apps/<app>/local) as well as in the system folder. Option E is incorrect because it reverses the actual precedence: 'local' takes precedence over 'default', not the other way around.

Answer

Files in 'default' should be edited to update Splunk settings

Answer

'local' directories only exist in the system folder

Answer

'default' files take precedence over 'local'

Question 9

Which TWO of the following are valid stanza types found in indexes.conf?

Accepted Answer

[default]. Option B, [default], is correct because indexes.conf uses a [default] stanza to define global settings that apply to all indexes unless overridden by a specific index stanza. Option E, [index_name], is correct because indexes.conf is organized around per-index stanzas, where each stanza name is the actual name of an index (for example, [main], [summary], or [my_index]) and contains that index's settings. Option A, [tcpout], is not valid in indexes.conf; tcpout stanzas belong in outputs.conf and configure forwarding destinations. Option C, [input], is not a valid indexes.conf stanza type; input stanzas are defined in inputs.conf. Option D, [source::...], is not valid in indexes.conf; source-based stanzas are used in props.conf and transforms.conf for source-type and field processing rules.

Answer

[tcpout]

Answer

[input]

Answer

[source::...]

Question 10

Which THREE of the following represent true statements about the 'transforms.conf' file?

Accepted Answer

It is used to perform data masking or anonymization. Option A is correct because transforms.conf defines transform stanzas that can apply regex-based field manipulation, including masking or anonymizing sensitive data via settings like REGEX and FORMAT or DEST_KEY. Option B is correct because transforms.conf supports routing events to different indexes using a transform with DEST_KEY = _MetaData:Index and a FORMAT that sets the target index, typically invoked from props.conf. Option C is correct because props.conf references transforms.conf stanzas through attributes such as TRANSFORMS- and REPORT- to perform field extractions and other transformations at search time or index time. Option D is not correct because TCP inputs are configured in inputs.conf with stanzas like [tcp://], not transforms.conf. Option E is not correct because sourcetype assignment is defined in inputs.conf (e.g., sourcetype=) or via props.conf, not in transforms.conf.

Answer

It is the primary file for setting up TCP inputs

Answer

It is used to define the sourcetype of data

Question 11

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/local/. Option B ($SPLUNK_HOME/etc/apps/my_app/local/) is correct because the local directory inside an app's configuration folder is a valid, supported location for custom configuration files such as inputs.conf, and it takes precedence over the app's default directory. Option D ($SPLUNK_HOME/etc/system/local/) is correct because the system/local directory is the standard location for custom, system-wide configuration overrides, including inputs.conf, and it is honored by Splunk at the system level. Option A ($SPLUNK_HOME/etc/system/default/) is not valid for custom files, as the default directory holds Splunk's built-in, shipped configurations and should not be modified by administrators. Option C ($SPLUNK_HOME/var/lib/) is incorrect because that path is used for Splunk's runtime and index data, not for configuration files. Option E ($SPLUNK_HOME/etc/apps/my_app/default/) is not appropriate for custom inputs.conf because the default directory is reserved for an app's shipped default settings, and user customizations belong in the app's local directory instead.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/my_app/default/

Question 12

A Splunk administrator needs to ensure that events from a custom sourcetype named 'myapp:log' are timestamped using the format '%Y-%m-%d %H:%M:%S.%3N' and that the timezone is set to UTC. The sourcetype is defined in an app named 'myapp' located at $SPLUNK_HOME/etc/apps/myapp. The administrator wants this configuration to apply only to this app and not affect other apps. Which configuration file and stanza should be edited?

Accepted Answer

$SPLUNK_HOME/etc/apps/myapp/local/props.conf, stanza [myapp:log]. Timestamp recognition and timezone settings are configured in props.conf under a sourcetype stanza. To limit the configuration to a specific app, the file must reside in that app's local directory. The local directory overrides default and is scoped to the app, ensuring other apps are unaffected. The correct file and stanza are props.conf with the sourcetype stanza in the app's local folder.

Answer

$SPLUNK_HOME/etc/system/local/props.conf, stanza [myapp:log]

Answer

$SPLUNK_HOME/etc/apps/myapp/local/inputs.conf, stanza [myapp:log]

Answer

$SPLUNK_HOME/etc/apps/myapp/default/transforms.conf, stanza [myapp:log]

Question 13

A Splunk administrator needs to ensure that a specific sourcetype is assigned to data coming from a particular source path. The administrator wants to define the sourcetype at the forwarder before data leaves the host. Which configuration file should be edited on the universal forwarder?

Accepted Answer

inputs.conf. inputs.conf is the correct file for assigning a sourcetype to a specific data input on a universal forwarder. Each input stanza supports a sourcetype attribute that labels the incoming data before it is forwarded. This approach is efficient because the sourcetype is set at the source, avoiding indexer-side guessing.

Answer

props.conf

Answer

transforms.conf

Answer

outputs.conf

Question 14

An administrator is troubleshooting why a custom field extraction defined in props.conf is not being applied to events. The extraction uses a REPORT-class stanza that references a transform in transforms.conf. After running btool props list --debug, the administrator sees the REPORT setting is active. What is the next most likely configuration issue to investigate?

Accepted Answer

The transforms.conf stanza name referenced by REPORT does not match the actual stanza name in transforms.conf.. After confirming that the REPORT setting is present and active in the merged props.conf, the next likely failure point is the transforms.conf stanza it references. If the stanza name in transforms.conf does not exactly match the name used in the REPORT setting, the field extraction will not run. Verifying that correspondence is the correct next diagnostic step.

Answer

The indexer requires a full restart rather than a configuration reload to apply REPORT settings.

Answer

The props.conf file must be placed in $SPLUNK_HOME/etc/system/default for REPORT settings to function.

Answer

The sourcetype in props.conf must be prefixed with 'sourcetype:' for REPORT to be recognized.

Question 15

A Splunk administrator is troubleshooting why a newly created sourcetype is not being assigned to incoming data from a Universal Forwarder. The administrator suspects a configuration conflict. Which command should be used to determine the effective configuration and the file that is providing the sourcetype definition?

Accepted Answer

splunk btool props list --debug. The btool command is designed to display the effective configuration by merging settings from all applicable configuration files. Using 'splunk btool props list --debug' shows the merged props.conf and includes the file path for each setting, which is essential for troubleshooting configuration conflicts such as a sourcetype not being applied as expected.

Answer

splunk list config

Answer

splunk show config props

Answer

splunk diag --conf