SPLK-1003 Configuration Files — Timed 10 Questions

Question 1

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Accepted Answer

The file sorted alphabetically by name. When two stanzas have the same precedence, Splunk resolves the conflict by sorting the configuration files alphabetically by filename and using the one that comes last (or first, depending on context—Splunk uses the file that sorts later alphabetically as higher precedence within the same directory). The correct answer as given is 'The file sorted alphabetically by name' because Splunk's configuration file precedence rules specify that within the same precedence level, files are processed in reverse alphabetical order, so the alphabetically last file wins. This deterministic rule ensures consistent behavior.

Answer

The file with the largest size

Answer

It randomly chooses one

Answer

The file created most recently

Question 2

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Accepted Answer

splunk cmd btool props list --debug. splunk btool is the standard CLI utility to show the merged configuration files for a specific context.

Answer

splunk show-config

Answer

splunk edit props

Answer

splunk list configs

Question 3

Where is the global configuration for Splunk Enterprise stored?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. Global configuration for Splunk Enterprise is stored under $SPLUNK_HOME/etc/system/. The system/default/ directory contains shipped global defaults, while system/local/ holds administrator-created global overrides that apply across all apps and users. Files in system/local take precedence over system/default and are preserved across upgrades; among the listed choices, $SPLUNK_HOME/etc/system/local/ is the directory under that hierarchy for global overrides.

Answer

$SPLUNK_HOME/etc/users/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/

Question 4

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Accepted Answer

inputs.conf. inputs.conf is the standard file for configuring data inputs like TCP ports.

Answer

outputs.conf

Answer

props.conf

Answer

server.conf

Question 5

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Accepted Answer

--debug. The `--debug` flag with btool displays the source file path and line number for each setting in the merged configuration. When troubleshooting parsing issues, this flag helps identify which file contributed a specific setting, allowing you to trace the configuration source. Example: `splunk btool props list --debug`.

Answer

--show-files

Answer

--list-files

Answer

--source

Question 6

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

Accepted Answer

[tcpout]. The [tcpout] stanza in outputs.conf defines the default group of indexers that a forwarder sends data to. To send specific data to a specific indexer, you configure a target group within [tcpout] and then reference that group in inputs.conf or props.conf/transforms.conf. The [tcpout] stanza is the correct place because it controls outbound TCP connections to indexers, which is exactly what's needed to direct data to a specific indexer.

Answer

[index]

Answer

[forwarder]

Answer

[indexer]

Question 7

Which stanza is required in props.conf to identify a sourcetype?

Accepted Answer

[sourcetype]. In props.conf, a sourcetype stanza is identified by the sourcetype name enclosed in square brackets, e.g., [mysourcetype]. This stanza then contains settings like SHOULD_LINEMERGE, TIME_PREFIX, TRANSFORMS-<class>, and FIELDALIAS. The stanza header itself is what identifies the sourcetype; there is no separate 'sourcetype =' key inside props.conf for this purpose.

Answer

[default]

Answer

sourcetype = name

Answer

[source::name]

Question 8

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

Accepted Answer

splunk btool props list --debug. The `splunk btool props list --debug` command is the correct tool because it lists all effective `props.conf` settings for every sourcetype and, with the `--debug` flag, shows the exact file path and line number where each setting is defined. This directly answers the question of which configuration file is responsible for a sourcetype's behavior, making it indispensable for troubleshooting why a sourcetype is not applying as expected. Other commands either do not exist or lack the file-level detail needed for debugging.

Answer

splunk list sourcetypes

Answer

splunk show props

Answer

splunk inspect props

Question 9

Which TWO of the following are valid ways to define field extractions?

Accepted Answer

Using the EXTRACT- prefix in props.conf. Option C is correct because Splunk supports inline field extractions defined in props.conf using stanza settings prefixed with EXTRACT-, where the value is a regex with a named capture group (e.g., EXTRACT-foo = (?<fieldname>pattern)); this is the standard way to define regex-based field extractions at search time. Option E is correct because the REPORT- prefix in props.conf references a stanza name in transforms.conf (e.g., REPORT-foo = my_transform), which defines a regex-based or delimiter-based extraction performed at search time via the transform's REGEX or DELIMS setting. Option A is incorrect because inputs.conf configures data inputs (monitors, network ports, scripted inputs) and does not define field extractions. Option B is incorrect because transforms.conf uses the REGEX or DELIMS attributes for extractions, not an INDEXED-EXTRACTION attribute. Option D is incorrect because field extractions are not defined by placing a CSV file in etc/system/local; CSV-based lookups are configured via lookup definitions in transforms.conf and referenced from props.conf, not by file placement alone.

Answer

Directly in inputs.conf

Answer

Using the INDEXED-EXTRACTION attribute in transforms.conf

Answer

Using a CSV file in etc/system/local

Question 10

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. Option A is correct because btool parses and validates configuration files, so running it (e.g., `splunk btool <conf> list`) surfaces syntax errors in .conf files that would otherwise break Splunk. Option D is correct because adding the `--debug` flag makes btool print the source file (and stanza) from which each setting value is derived, which is essential for troubleshooting precedence. Option E is correct because btool's core purpose is to show the effective, merged configuration after applying the full precedence order (system default, app, user, etc.), i.e., the final output Splunk actually uses. Option B is not correct because btool is read-only and never writes or modifies configuration files. Option C is not correct because btool does not manage the Splunk service; restarting is done via `splunk restart` or the service manager, not btool.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service