SPLK-1003 Configuration Files — Timed 25 Questions

Question 1

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Accepted Answer

The file sorted alphabetically by name. When two stanzas have the same precedence, Splunk resolves the conflict by sorting the configuration files alphabetically by filename and using the one that comes last (or first, depending on context—Splunk uses the file that sorts later alphabetically as higher precedence within the same directory). The correct answer as given is 'The file sorted alphabetically by name' because Splunk's configuration file precedence rules specify that within the same precedence level, files are processed in reverse alphabetical order, so the alphabetically last file wins. This deterministic rule ensures consistent behavior.

Answer

The file with the largest size

Answer

It randomly chooses one

Answer

The file created most recently

Question 2

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Accepted Answer

splunk cmd btool props list --debug. splunk btool is the standard CLI utility to show the merged configuration files for a specific context.

Answer

splunk show-config

Answer

splunk edit props

Answer

splunk list configs

Question 3

Where is the global configuration for Splunk Enterprise stored?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. Global configuration for Splunk Enterprise is stored under $SPLUNK_HOME/etc/system/. The system/default/ directory contains shipped global defaults, while system/local/ holds administrator-created global overrides that apply across all apps and users. Files in system/local take precedence over system/default and are preserved across upgrades; among the listed choices, $SPLUNK_HOME/etc/system/local/ is the directory under that hierarchy for global overrides.

Answer

$SPLUNK_HOME/etc/users/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/

Question 4

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Accepted Answer

inputs.conf. inputs.conf is the standard file for configuring data inputs like TCP ports.

Answer

outputs.conf

Answer

props.conf

Answer

server.conf

Question 5

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Accepted Answer

--debug. The `--debug` flag with btool displays the source file path and line number for each setting in the merged configuration. When troubleshooting parsing issues, this flag helps identify which file contributed a specific setting, allowing you to trace the configuration source. Example: `splunk btool props list --debug`.

Answer

--show-files

Answer

--list-files

Answer

--source

Question 6

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

Accepted Answer

[tcpout]. The [tcpout] stanza in outputs.conf defines the default group of indexers that a forwarder sends data to. To send specific data to a specific indexer, you configure a target group within [tcpout] and then reference that group in inputs.conf or props.conf/transforms.conf. The [tcpout] stanza is the correct place because it controls outbound TCP connections to indexers, which is exactly what's needed to direct data to a specific indexer.

Answer

[index]

Answer

[forwarder]

Answer

[indexer]

Question 7

Which stanza is required in props.conf to identify a sourcetype?

Accepted Answer

[sourcetype]. In props.conf, a sourcetype stanza is identified by the sourcetype name enclosed in square brackets, e.g., [mysourcetype]. This stanza then contains settings like SHOULD_LINEMERGE, TIME_PREFIX, TRANSFORMS-<class>, and FIELDALIAS. The stanza header itself is what identifies the sourcetype; there is no separate 'sourcetype =' key inside props.conf for this purpose.

Answer

[default]

Answer

sourcetype = name

Answer

[source::name]

Question 8

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

Accepted Answer

splunk btool props list --debug. The `splunk btool props list --debug` command is the correct tool because it lists all effective `props.conf` settings for every sourcetype and, with the `--debug` flag, shows the exact file path and line number where each setting is defined. This directly answers the question of which configuration file is responsible for a sourcetype's behavior, making it indispensable for troubleshooting why a sourcetype is not applying as expected. Other commands either do not exist or lack the file-level detail needed for debugging.

Answer

splunk list sourcetypes

Answer

splunk show props

Answer

splunk inspect props

Question 9

Which TWO of the following are valid ways to define field extractions?

Accepted Answer

Using the EXTRACT- prefix in props.conf. Option C is correct because Splunk supports inline field extractions defined in props.conf using stanza settings prefixed with EXTRACT-, where the value is a regex with a named capture group (e.g., EXTRACT-foo = (?<fieldname>pattern)); this is the standard way to define regex-based field extractions at search time. Option E is correct because the REPORT- prefix in props.conf references a stanza name in transforms.conf (e.g., REPORT-foo = my_transform), which defines a regex-based or delimiter-based extraction performed at search time via the transform's REGEX or DELIMS setting. Option A is incorrect because inputs.conf configures data inputs (monitors, network ports, scripted inputs) and does not define field extractions. Option B is incorrect because transforms.conf uses the REGEX or DELIMS attributes for extractions, not an INDEXED-EXTRACTION attribute. Option D is incorrect because field extractions are not defined by placing a CSV file in etc/system/local; CSV-based lookups are configured via lookup definitions in transforms.conf and referenced from props.conf, not by file placement alone.

Answer

Directly in inputs.conf

Answer

Using the INDEXED-EXTRACTION attribute in transforms.conf

Answer

Using a CSV file in etc/system/local

Question 10

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. Option A is correct because btool parses and validates configuration files, so running it (e.g., `splunk btool <conf> list`) surfaces syntax errors in .conf files that would otherwise break Splunk. Option D is correct because adding the `--debug` flag makes btool print the source file (and stanza) from which each setting value is derived, which is essential for troubleshooting precedence. Option E is correct because btool's core purpose is to show the effective, merged configuration after applying the full precedence order (system default, app, user, etc.), i.e., the final output Splunk actually uses. Option B is not correct because btool is read-only and never writes or modifies configuration files. Option C is not correct because btool does not manage the Splunk service; restarting is done via `splunk restart` or the service manager, not btool.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service

Question 11

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Accepted Answer

$SPLUNK_HOME/etc/apps/app_name/default. Option B, $SPLUNK_HOME/etc/apps/app_name/default, is correct because app-level default configuration files are part of Splunk's configuration file precedence hierarchy, sitting above system defaults and below app-level local and user-level settings. Option C, $SPLUNK_HOME/etc/system/default, is correct because system default configuration files form the base layer of the precedence hierarchy, providing the lowest-priority settings that all other configuration layers can override. Option A, $SPLUNK_HOME/var/run, is incorrect because it holds runtime files such as process IDs and search dispatch artifacts, not configuration files. Option D, $SPLUNK_HOME/etc/licenses, is incorrect because it stores license keys and license group configuration, not part of the general configuration precedence chain. Option E, $SPLUNK_HOME/etc/users/admin, is incorrect because while user-level directories do participate in precedence, the specific path shown is not one of the two standard directories tested here and user context directories are named by user, not a fixed admin path in the hierarchy definition.

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/etc/licenses

Answer

$SPLUNK_HOME/etc/users/admin

Question 12

Which TWO attributes in props.conf are commonly used to handle multiline events?

Accepted Answer

BREAK_ONLY_BEFORE. In props.conf, SHOULD_LINEMERGE (option E) is the stanza-level setting that controls whether Splunk merges multiple lines into a single event, and it is the primary attribute used when handling multiline events such as Java stack traces. BREAK_ONLY_BEFORE (option D) works together with line merging by specifying a regular expression that identifies the start of a new event, so lines matching it begin a new event while preceding lines are appended to the prior one. Together these two attributes are the classic props.conf approach for multiline event handling. INDEXED_EXTRACTION (A) is a props.conf setting for extracting fields at index time, not for line breaking. TIME_FORMAT (B) defines how timestamps are parsed, and TRANSFORMS-routing (C) is used in props.conf to route events to queues or indexes, neither of which controls multiline event boundaries.

Answer

INDEXED_EXTRACTION

Answer

TIME_FORMAT

Answer

TRANSFORMS-routing

Question 13

Which THREE of the following are true regarding the configuration precedence of apps?

Accepted Answer

You can use app.conf to control the precedence of apps. Option A is correct because app.conf is the configuration file used to define and control an app's precedence within Splunk, allowing administrators to set the order in which apps are loaded and which settings win. Option B is correct because an app's local directory takes precedence over its default directory, meaning any setting defined in local overrides the same setting in default. Option D is correct because system default settings are overridden by app settings, since app-level configuration has higher precedence than the system defaults layer. Option C is incorrect because user settings actually take precedence over app settings, not less importance. Option E is incorrect because app precedence is not determined by the directory order in etc/apps; it is controlled through app.conf, not filesystem ordering.

Answer

User settings are less important than app settings

Answer

App precedence is defined by the directory order in etc/apps

Question 14

An administrator needs to increase the number of concurrent search jobs a search head can run. The current limit is set in $SPLUNK_HOME/etc/system/default/limits.conf. The administrator creates $SPLUNK_HOME/etc/system/local/limits.conf with a higher value but the change does not take effect after restarting Splunk. What should the administrator check first?

Accepted Answer

Whether the setting in $SPLUNK_HOME/etc/apps/search/local/limits.conf overrides the system/local value.. Splunk merges configuration files using a defined precedence order, and app-level settings in etc/apps/<app>/local override system-level settings in etc/system/local. When a change in system/local appears ineffective, checking for a conflicting higher-precedence setting in an app's local directory is the correct first step. The search app is a common location for such overrides.

Answer

Whether the administrator needs to run splunk reload deploy-server to push the configuration.

Answer

Whether the limits.conf file needs to be placed in $SPLUNK_HOME/etc/system/default instead of local.

Answer

Whether the search head requires a rolling restart of all indexers to apply limits.conf changes.

Question 15

A Splunk administrator deploys a new technical add-on to a search head cluster. The add-on includes a props.conf stanza that sets LINE_BREAKER for a custom sourcetype. After deployment, the administrator runs btool props list --debug and notices that the effective LINE_BREAKER value differs from the one defined in the add-on's default/props.conf. Where should the administrator look FIRST to determine why the add-on's setting is not taking effect?

Accepted Answer

The system/local/props.conf file on the search head cluster members. Splunk merges configuration files using a precedence order: system/local overrides app local, which overrides app default, and so on. When btool shows a value different from an add-on's default/props.conf, the most likely cause is a higher-precedence file, especially system/local/props.conf. Checking that file first quickly reveals whether an administrator has overridden the add-on's parsing rule.

Answer

The search head cluster's replication factor settings in server.conf

Answer

The add-on's local/props.conf file

Answer

The indexes.conf file on the indexers

Question 16

A Splunk administrator wants to configure a universal forwarder to send data to two separate indexers for redundancy. The administrator edits $SPLUNK_HOME/etc/system/local/outputs.conf and defines two [tcpout:group1] and [tcpout:group2] stanzas, then adds [tcpout] with defaultGroup = group1, group2. After restarting, data is only reaching group1. What is the most likely cause?

Accepted Answer

The defaultGroup setting requires groups to be separated by commas without spaces.. The defaultGroup attribute in the [tcpout] stanza uses a comma-separated list with no spaces. Including a space after the comma causes the second group name to be parsed incorrectly, so the forwarder only sends to the first group. Correcting the syntax to 'group1,group2' allows data to flow to both indexer groups.

Answer

Universal forwarders cannot send to multiple indexer groups simultaneously.

Answer

The forwarder requires the use of a load-balancing scheme such as autoLB in the defaultGroup stanza.

Answer

Each tcpout group must include the indexAndForward = true setting to receive data.

Question 17

A Splunk admin is troubleshooting why a forwarder is not sending data to the indexer. The forwarder's outputs.conf contains a single stanza [tcpout:myindexers] with server = indexer1:9997, indexer2:9997. The admin notices that data is being queued but not sent, and the indexer is reachable. Which configuration file should the admin check to verify that the forwarder is actually using the 'myindexers' target group?

Accepted Answer

$SPLUNK_HOME/etc/system/local/outputs.conf, specifically the [tcpout] stanza's defaultGroup setting. The forwarder uses the defaultGroup setting in the [tcpout] stanza of outputs.conf to determine which target group to send data to. If this setting is missing or incorrect, the forwarder may not send data even if the target group is defined. The admin should verify that defaultGroup is set to 'myindexers' in the appropriate outputs.conf, typically in system/local or an app's local directory.

Answer

$SPLUNK_HOME/etc/system/local/inputs.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/outputs.conf

Answer

$SPLUNK_HOME/etc/system/local/outputs.conf

Question 18

An administrator needs to ensure that a new sourcetype stanza defined in an app's local directory takes effect over an identically named stanza in another app's default directory. According to Splunk's configuration file precedence, which action will guarantee this outcome?

Accepted Answer

Place the stanza in $SPLUNK_HOME/etc/system/local/.. Configuration precedence in Splunk follows a specific order: system local overrides app local, which overrides app default, and system default is lowest. To guarantee that a stanza overrides an identically named one in another app's default, placing it in system/local is the most reliable method because system local has the highest precedence. This ensures the setting is applied regardless of app ordering or other app-level configurations.

Answer

Place the stanza in $SPLUNK_HOME/etc/apps/<app_name>/local/ of an app that is earlier in the app precedence order.

Answer

Place the stanza in $SPLUNK_HOME/etc/apps/<app_name>/default/ of the app with the highest precedence.

Answer

Use btool to merge the configurations and then restart Splunk.

Question 19

A Splunk administrator is configuring a new indexer to receive data from forwarders. The administrator wants to ensure that the indexer's configuration files are correctly layered so that a custom setting in an app's local directory takes precedence over the same setting in the app's default directory. Which TWO statements accurately describe Splunk's configuration file precedence and merging behavior? (Choose two.)

Accepted Answer

Settings in $SPLUNK_HOME/etc/system/local override settings in any app's local directory.. Splunk merges configuration files using a defined precedence order. Within an app, local overrides default. Across the system, system/local overrides all app directories. Understanding these two rules allows an administrator to place custom settings in the correct location so they take effect as intended, while avoiding unintended overrides from higher-precedence files.

Answer

Settings in an app's default directory override settings in another app's local directory.

Answer

Configuration files are merged at the stanza and key level, so a setting not defined in a higher-precedence file is inherited from a lower-precedence file.

Answer

When two apps define the same setting at the same precedence level, the app with the alphabetically first name wins.

Question 20

A Splunk administrator needs to change the maximum size of the in-memory queue that holds events before they are written to disk. The administrator wants this change to apply only to the indexer tier and not be overridden by any app. Which file and directory should be edited?

Accepted Answer

$SPLUNK_HOME/etc/system/local/indexes.conf. Queue sizing for an index is defined by maxMemMB in indexes.conf. To ensure the setting is not overridden by any app, it must be placed in the system/local directory, which has the highest precedence for system-wide configuration. The default directory is reserved for Splunk's internal defaults and should not be modified.

Answer

$SPLUNK_HOME/etc/system/default/inputs.conf

Answer

$SPLUNK_HOME/etc/system/local/server.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/indexes.conf