SPLK-1003 Getting Data IN And Forwarder Management — 30 Questions

Question 1

To monitor a network port using a Universal Forwarder, which stanza should be added to inputs.conf?

Accepted Answer

[tcp://9997]. To monitor a network port with a Universal Forwarder, you configure a TCP input in inputs.conf using the [tcp://<port>] stanza, which tells the forwarder to listen on that port for incoming data. The [tcp://9997] stanza is the correct syntax for a TCP network input. This is distinct from the [monitor://] stanza used for file monitoring and the [splunktcp://9997] stanza used for receiving forwarded data from other forwarders.

Answer

[script://./bin/my.py]

Answer

[monitor:///var/log/]

Answer

[winhost://]

Question 2

You have a deployment server managing 500 Universal Forwarders. You need to update a specific app for only 50 of them based on OS type. How should you organize the deployment?

Accepted Answer

Create two server classes and use machine class filters.. To deploy an app to only 50 out of 500 forwarders based on OS type, you should create two server classes: one for the 50 target forwarders (using machine class filters like machineTypesFilter) and another for the remaining forwarders. This allows granular control via serverclass.conf.

Answer

Use an Intermediate Forwarder for the 50 machines.

Answer

Modify the global serverclass.conf without a class.

Answer

Manually copy the app to the forwarders.

Question 3

You are deploying a Universal Forwarder to a Windows server that must monitor local Event Logs and send them to an Indexer. Which component is required to handle the parsing of these logs before they are forwarded?

Accepted Answer

The Indexer. Universal Forwarders do not perform heavy parsing. They forward data as-is, and the Indexer handles the parsing.

Answer

The Deployment Server

Answer

An intermediate UF

Answer

A Heavy Forwarder

Question 4

Which user interface feature allows you to view the connectivity status of all forwarders reporting to an Indexer?

Accepted Answer

Forwarder Management. The Forwarder Management dashboard provides a high-level view of connected forwarders.

Answer

License Manager

Answer

Data Inputs

Answer

Indexes

Question 5

When using a Heavy Forwarder to perform data masking, which stanza in transforms.conf is used to define the replacement regex?

Accepted Answer

[my_masking_rule]. In Splunk, transforms.conf stanzas define data transformations, and the stanza name (e.g., [my_masking_rule]) is referenced by props.conf to apply the transform. The masking rule itself, including the REGEX and FORMAT (or DEST_KEY) used for replacement, is defined inside that named stanza in transforms.conf.

Answer

[index_rule]

Answer

[forward_rule]

Answer

[input_rule]

Question 6

You need to ensure that a specific app deployed via Deployment Server overwrites local configurations on the client. What is the correct way to handle this?

Accepted Answer

Use the 'restartSplunkd = true' attribute in serverclass.conf.. App precedence is managed by directory hierarchy; app directory content is overwritten by local configuration in some cases, but specifically, you use the 'restart' or 'reload' attributes in serverclass.conf, and deployment server overrides are controlled by file precedence.

Answer

Use the 'override = true' flag in inputs.conf.

Answer

Use the 'priority' attribute in serverclass.conf.

Answer

Manually delete the local files.

Question 7

Which THREE items should be included in a deployment app package distributed by the Deployment Server?

Accepted Answer

inputs.conf. Apps typically contain configuration files, scripts, and potential lookup files.

Answer

indexes.conf

Answer

splunk-launch.conf

Question 8

Which TWO settings in outputs.conf are recommended for load balancing data across multiple indexers?

Accepted Answer

autoLBFrequency. In Splunk's outputs.conf, load balancing across multiple indexers is configured by listing the target indexers in the indexerList setting (option D), which defines the group of indexers that the forwarder distributes data to. The autoLBFrequency setting (option B) controls how often the forwarder re-evaluates and switches to a different indexer for load balancing, making it a recommended companion setting for distributing data evenly. Together, indexerList and autoLBFrequency provide the core mechanism for automatic load balancing in a forwarder-to-indexer configuration. The unmarked options do not belong: serverName (A) is used to identify a specific server, not to balance across indexers; sslPassword (C) is for SSL certificate key passwords, unrelated to load balancing; and index (E) is not a valid outputs.conf load-balancing setting.

Answer

serverName

Answer

sslPassword

Answer

index

Question 9

Which THREE attributes can be used in serverclass.conf to define target clients?

Accepted Answer

whitelist. In Splunk's serverclass.conf, target clients for a server class are defined using filter attributes: whitelist (A) matches clients by hostname/IP pattern, blacklist (E) excludes clients from the class, and machineTypesFilter (D) matches clients by their machine type (e.g., a deployment client's configured machine type). These three are the standard filtering keys used to scope which deployment clients receive an app or configuration. portFilter (B) is not a valid serverclass.conf filter attribute, and indexFilter (C) is not a serverclass targeting attribute either — index filtering belongs to index-time/search configuration, not deployment server class targeting.

Answer

portFilter

Answer

indexFilter

Question 10

You are configuring a Heavy Forwarder to mask sensitive credit card information before the data reaches the indexer. Which configuration file must you modify to implement this data transformation?

Accepted Answer

transforms.conf. Data masking and anonymization in Splunk are implemented through field transformations defined in transforms.conf, which specify regex-based sed expressions or lookup-based replacements. A props.conf stanza references the transform via the TRANSFORMS-<class> setting, and the transform itself lives in transforms.conf. Because masking must occur before indexing on a Heavy Forwarder, transforms.conf is the correct file to modify.

Answer

server.conf

Answer

inputs.conf

Answer

outputs.conf

Question 11

You need to ensure that a Universal Forwarder continues to collect data during a network outage between the forwarder and the indexer. Which feature should be enabled in outputs.conf?

Accepted Answer

Persistent queues. Persistent queues (configured via `persistentQueueSize` in outputs.conf, or more precisely in the queue settings) ensure that data is written to disk on the forwarder before being sent to the indexer. If the network goes down, the forwarder retains the data on disk and resumes sending when connectivity is restored, preventing data loss during outages.

Answer

Forwarder queue buffering

Answer

Indexer acknowledgment

Answer

Auto-load balancing

Question 12

A Splunk administrator is preparing to deploy a new version of a custom app to 50 Universal Forwarders using the Deployment Server. The app includes a new inputs.conf that changes the sourcetype of a monitored log. After deployment, the administrator notices that the forwarders are not picking up the new inputs.conf. The Deployment Server shows the app as successfully deployed. Which of the following is the most likely cause?

Accepted Answer

The forwarders require a restart to apply changes to inputs.conf.. Universal Forwarders do not automatically reload inputs.conf after a Deployment Server pushes a new app. A restart of the forwarder service is necessary for the new inputs to be read. The Deployment Server's success message only confirms the app was downloaded, not that it is active. Restarting ensures the configuration is applied.

Answer

The inputs.conf file must be placed in the $SPLUNK_HOME/etc/system/local directory instead of the app directory.

Answer

The Deployment Server did not push the app because the forwarders are not in the correct serverclass.

Answer

The app was deployed to the wrong serverclass, so the forwarders did not receive it.

Question 13

A Splunk administrator needs to configure a Universal Forwarder to send data to an indexer cluster. The indexer cluster has three indexers, and the administrator wants to ensure that the forwarder can continue sending data if one indexer becomes unavailable. Which two configurations should be set on the Universal Forwarder to achieve this? (Choose two.)

Accepted Answer

Set useACK=true in outputs.conf to enable indexer acknowledgment.. To ensure data continues to flow if an indexer fails, the Universal Forwarder must have outputs.conf listing all indexers and useACK=true enabled. Listing multiple indexers allows failover, and acknowledgment ensures data is not lost if an indexer goes down before receiving data. These two settings together provide high availability.

Answer

Set autoLB=true in outputs.conf to enable automatic load balancing.

Answer

Configure inputs.conf to send data directly to each indexer in a round-robin fashion.

Answer

Configure the forwarder to use a deployment server to manage indexer lists.

Question 14

A Splunk administrator needs to collect data from a custom application on 200 Linux servers. The application writes to /opt/app/logs/current.log and rotates the file to /opt/app/logs/current.log.1 at midnight every day. The administrator must ensure that no data is lost during rotation and that the Universal Forwarders do not require a restart. Which configuration should be applied to the inputs.conf on the forwarders?

Accepted Answer

Configure a monitor input with the default settings for /opt/app/logs/current.log.. The default monitor input in inputs.conf is designed to handle log rotation automatically. It uses file tracking mechanisms such as inode and file signature to detect when a file is rotated and continues reading from the new file. This ensures no data loss without additional configuration or forwarder restarts.

Answer

Use a batch input with a cron schedule to read the file every minute.

Answer

Set crcSalt = <SOURCE> on the monitor input to ensure unique file tracking.

Answer

Set followTail = 1 on the [monitor:///opt/app/logs/current.log] stanza.

Question 15

A Splunk administrator has a Universal Forwarder installed on a Linux host. They need to monitor a directory that contains log files which are actively being written to and rotated daily with a .log extension. They want to ensure that Splunk reads the files from the beginning when they are first discovered, but does not read old rotated files that were already processed. Which configuration in inputs.conf should they use?

Accepted Answer

Set 'followTail = 0' to read from the beginning of the file on first discovery.. The requirement is to read new files from the beginning while avoiding reprocessing of already processed rotated files. Setting followTail = 0 ensures that Splunk reads from the start of the file when it is first discovered. The fishbucket tracks file states, so rotated files that have been read will not be re-ingested. Other settings like crcSalt or initCrcLength affect file identification but not the initial read position.

Answer

Set 'crcSalt = <SOURCE>' to ensure files are uniquely identified.

Answer

Set 'initCrcLength = 1024' to increase the number of bytes used for CRC calculation.

Answer

Set 'ignoreOlderThan = 7d' to skip files older than 7 days.

Question 16

A Splunk administrator must configure a Universal Forwarder on a Linux host to monitor a directory whose files are rotated and renamed frequently, and to ensure that no data is lost if the forwarder is temporarily stopped. The administrator also wants to avoid re-indexing files after a restart. Which combination of settings should be applied to the inputs.conf stanza?

Accepted Answer

Set followTail = 0 and use the default checkpointing, and ensure that the fishbucket index is properly persisted.. The correct configuration ensures that the forwarder reads all existing data (followTail = 0) and resumes from the last read position after a restart via default checkpointing. Persisting the fishbucket index is essential to maintain read offsets. The other options either skip existing data, cause duplicates, or disable checkpointing, which would lead to data loss or re-indexing.

Answer

Set crcSalt = <SOURCE> and followTail = 0, and leave the default checkpoint behavior.

Answer

Set initCrcLength = 1024 and ignoreOlderThan = 7d, and set followTail = 1.

Answer

Set followTail = 1 and crcSalt = <SOURCE>, and disable checkpointing by setting checkpointInterval = 0.

Question 17

You are a Splunk administrator at a financial services company. A Windows server running the Universal Forwarder has been reporting to the Deployment Server, but after a recent change, the forwarder stopped receiving deployment apps and its configuration reverted unexpectedly. You check the forwarder's splunkd.log and see repeated messages about being unable to fetch the deployment server's configuration. Which of the following is the most likely cause?

Accepted Answer

The forwarder's deploymentclient.conf is missing or misconfigured, so it cannot locate the Deployment Server.. The deploymentclient.conf file is essential for a forwarder to locate and communicate with the Deployment Server. When this file is missing or misconfigured, the forwarder cannot fetch deployment apps, leading to configuration reversion and errors in splunkd.log. The other options either affect all forwarders or are unrelated to the deployment client communication path.

Answer

The forwarder's serverclass.conf file on the Deployment Server has a syntax error.

Answer

The forwarder's outputs.conf is pointing to the wrong indexer, causing it to fail deployment.

Answer

The Deployment Server service is not running on the deployment server host.

Question 18

A Splunk administrator needs to monitor a set of log files on a Windows server using a Universal Forwarder. The logs are written to a directory that includes subdirectories, and the administrator wants to monitor all .log files recursively. Which input stanza in inputs.conf should be used?

Accepted Answer

[monitor://C:\Logs\...\*.log]. To monitor files recursively in Splunk on Windows, the monitor stanza must include the ... wildcard to indicate subdirectories. The correct syntax is [monitor://C:\Logs\...\*.log], which monitors all .log files in C:\Logs and its subdirectories. This ensures that all relevant log files are ingested, regardless of their depth in the directory structure.

Answer

[monitor://C:\Logs\*]

Answer

[monitor://C:\Logs\...]

Answer

[monitor://C:\Logs\*.log]

Question 19

A Splunk administrator needs to deploy a new version of a custom app to 50 Universal Forwarders using the Deployment Server. The app contains a inputs.conf that monitors a specific log file. The administrator wants to ensure that the forwarders receive the app and that the deployment is successful. Which action should the administrator take after placing the app in the deployment-apps directory?

Accepted Answer

Run the command splunk reload deploy-server on the Deployment Server.. The correct action is to run splunk reload deploy-server on the Deployment Server. This command causes the Deployment Server to re-read its configuration and detect the new app, making it available for deployment to forwarders. Restarting the service is unnecessary, and the other commands are used in different contexts.

Answer

Run the command splunk apply cluster-bundle on the Deployment Server.

Answer

Restart the Deployment Server service to apply the changes.

Answer

Edit serverclass.conf to add the app and then run splunk reload deploy-server.

Question 20

A Splunk administrator is setting up a new Universal Forwarder on a Linux server to monitor a critical application log file. The administrator wants to ensure that only new events appended to the file are indexed, and that the entire file is not re-indexed if the forwarder restarts. Which setting in inputs.conf should be configured to achieve this?

Accepted Answer

followTail. The followTail setting in inputs.conf instructs the Universal Forwarder to begin reading a file from its end, so only new data appended after monitoring starts is indexed. This prevents re-indexing of existing content when the forwarder restarts, which is essential for log files that already contain historical data. Other settings like ignoreOlderThan or crcSalt do not provide this behavior.

Answer

ignoreOlderThan

Answer

initCrcLength

Answer

crcSalt