SPLK-1003 Getting Data IN And Forwarder Management Practice Test 1 — 15 Questions

Question 1

To monitor a network port using a Universal Forwarder, which stanza should be added to inputs.conf?

Accepted Answer

[tcp://9997]. To monitor a network port with a Universal Forwarder, you configure a TCP input in inputs.conf using the [tcp://<port>] stanza, which tells the forwarder to listen on that port for incoming data. The [tcp://9997] stanza is the correct syntax for a TCP network input. This is distinct from the [monitor://] stanza used for file monitoring and the [splunktcp://9997] stanza used for receiving forwarded data from other forwarders.

Answer

[script://./bin/my.py]

Answer

[monitor:///var/log/]

Answer

[winhost://]

Question 2

You have a deployment server managing 500 Universal Forwarders. You need to update a specific app for only 50 of them based on OS type. How should you organize the deployment?

Accepted Answer

Create two server classes and use machine class filters.. To deploy an app to only 50 out of 500 forwarders based on OS type, you should create two server classes: one for the 50 target forwarders (using machine class filters like machineTypesFilter) and another for the remaining forwarders. This allows granular control via serverclass.conf.

Answer

Use an Intermediate Forwarder for the 50 machines.

Answer

Modify the global serverclass.conf without a class.

Answer

Manually copy the app to the forwarders.

Question 3

You are deploying a Universal Forwarder to a Windows server that must monitor local Event Logs and send them to an Indexer. Which component is required to handle the parsing of these logs before they are forwarded?

Accepted Answer

The Indexer. Universal Forwarders do not perform heavy parsing. They forward data as-is, and the Indexer handles the parsing.

Answer

The Deployment Server

Answer

An intermediate UF

Answer

A Heavy Forwarder

Question 4

Which user interface feature allows you to view the connectivity status of all forwarders reporting to an Indexer?

Accepted Answer

Forwarder Management. The Forwarder Management dashboard provides a high-level view of connected forwarders.

Answer

License Manager

Answer

Data Inputs

Answer

Indexes

Question 5

When using a Heavy Forwarder to perform data masking, which stanza in transforms.conf is used to define the replacement regex?

Accepted Answer

[my_masking_rule]. In Splunk, transforms.conf stanzas define data transformations, and the stanza name (e.g., [my_masking_rule]) is referenced by props.conf to apply the transform. The masking rule itself, including the REGEX and FORMAT (or DEST_KEY) used for replacement, is defined inside that named stanza in transforms.conf.

Answer

[index_rule]

Answer

[forward_rule]

Answer

[input_rule]

Question 6

You need to ensure that a specific app deployed via Deployment Server overwrites local configurations on the client. What is the correct way to handle this?

Accepted Answer

Use the 'restartSplunkd = true' attribute in serverclass.conf.. App precedence is managed by directory hierarchy; app directory content is overwritten by local configuration in some cases, but specifically, you use the 'restart' or 'reload' attributes in serverclass.conf, and deployment server overrides are controlled by file precedence.

Answer

Use the 'override = true' flag in inputs.conf.

Answer

Use the 'priority' attribute in serverclass.conf.

Answer

Manually delete the local files.

Question 7

Which THREE items should be included in a deployment app package distributed by the Deployment Server?

Accepted Answer

inputs.conf. Apps typically contain configuration files, scripts, and potential lookup files.

Answer

indexes.conf

Answer

splunk-launch.conf

Question 8

Which TWO settings in outputs.conf are recommended for load balancing data across multiple indexers?

Accepted Answer

autoLBFrequency. In Splunk's outputs.conf, load balancing across multiple indexers is configured by listing the target indexers in the indexerList setting (option D), which defines the group of indexers that the forwarder distributes data to. The autoLBFrequency setting (option B) controls how often the forwarder re-evaluates and switches to a different indexer for load balancing, making it a recommended companion setting for distributing data evenly. Together, indexerList and autoLBFrequency provide the core mechanism for automatic load balancing in a forwarder-to-indexer configuration. The unmarked options do not belong: serverName (A) is used to identify a specific server, not to balance across indexers; sslPassword (C) is for SSL certificate key passwords, unrelated to load balancing; and index (E) is not a valid outputs.conf load-balancing setting.

Answer

serverName

Answer

sslPassword

Answer

index

Question 9

Which THREE attributes can be used in serverclass.conf to define target clients?

Accepted Answer

whitelist. In Splunk's serverclass.conf, target clients for a server class are defined using filter attributes: whitelist (A) matches clients by hostname/IP pattern, blacklist (E) excludes clients from the class, and machineTypesFilter (D) matches clients by their machine type (e.g., a deployment client's configured machine type). These three are the standard filtering keys used to scope which deployment clients receive an app or configuration. portFilter (B) is not a valid serverclass.conf filter attribute, and indexFilter (C) is not a serverclass targeting attribute either — index filtering belongs to index-time/search configuration, not deployment server class targeting.

Answer

portFilter

Answer

indexFilter

Question 10

You are configuring a Heavy Forwarder to mask sensitive credit card information before the data reaches the indexer. Which configuration file must you modify to implement this data transformation?

Accepted Answer

transforms.conf. Data masking and anonymization in Splunk are implemented through field transformations defined in transforms.conf, which specify regex-based sed expressions or lookup-based replacements. A props.conf stanza references the transform via the TRANSFORMS-<class> setting, and the transform itself lives in transforms.conf. Because masking must occur before indexing on a Heavy Forwarder, transforms.conf is the correct file to modify.

Answer

server.conf

Answer

inputs.conf

Answer

outputs.conf

Question 11

You need to ensure that a Universal Forwarder continues to collect data during a network outage between the forwarder and the indexer. Which feature should be enabled in outputs.conf?

Accepted Answer

Persistent queues. Persistent queues (configured via `persistentQueueSize` in outputs.conf, or more precisely in the queue settings) ensure that data is written to disk on the forwarder before being sent to the indexer. If the network goes down, the forwarder retains the data on disk and resumes sending when connectivity is restored, preventing data loss during outages.

Answer

Forwarder queue buffering

Answer

Indexer acknowledgment

Answer

Auto-load balancing

Question 12

A Splunk administrator is preparing to deploy a new version of a custom app to 50 Universal Forwarders using the Deployment Server. The app includes a new inputs.conf that changes the sourcetype of a monitored log. After deployment, the administrator notices that the forwarders are not picking up the new inputs.conf. The Deployment Server shows the app as successfully deployed. Which of the following is the most likely cause?

Accepted Answer

The forwarders require a restart to apply changes to inputs.conf.. Universal Forwarders do not automatically reload inputs.conf after a Deployment Server pushes a new app. A restart of the forwarder service is necessary for the new inputs to be read. The Deployment Server's success message only confirms the app was downloaded, not that it is active. Restarting ensures the configuration is applied.

Answer

The inputs.conf file must be placed in the $SPLUNK_HOME/etc/system/local directory instead of the app directory.

Answer

The Deployment Server did not push the app because the forwarders are not in the correct serverclass.

Answer

The app was deployed to the wrong serverclass, so the forwarders did not receive it.

Question 13

A Splunk administrator needs to configure a Universal Forwarder to send data to an indexer cluster. The indexer cluster has three indexers, and the administrator wants to ensure that the forwarder can continue sending data if one indexer becomes unavailable. Which two configurations should be set on the Universal Forwarder to achieve this? (Choose two.)

Accepted Answer

Set useACK=true in outputs.conf to enable indexer acknowledgment.. To ensure data continues to flow if an indexer fails, the Universal Forwarder must have outputs.conf listing all indexers and useACK=true enabled. Listing multiple indexers allows failover, and acknowledgment ensures data is not lost if an indexer goes down before receiving data. These two settings together provide high availability.

Answer

Set autoLB=true in outputs.conf to enable automatic load balancing.

Answer

Configure inputs.conf to send data directly to each indexer in a round-robin fashion.

Answer

Configure the forwarder to use a deployment server to manage indexer lists.

Question 14

A Splunk administrator needs to collect data from a custom application on 200 Linux servers. The application writes to /opt/app/logs/current.log and rotates the file to /opt/app/logs/current.log.1 at midnight every day. The administrator must ensure that no data is lost during rotation and that the Universal Forwarders do not require a restart. Which configuration should be applied to the inputs.conf on the forwarders?

Accepted Answer

Configure a monitor input with the default settings for /opt/app/logs/current.log.. The default monitor input in inputs.conf is designed to handle log rotation automatically. It uses file tracking mechanisms such as inode and file signature to detect when a file is rotated and continues reading from the new file. This ensures no data loss without additional configuration or forwarder restarts.

Answer

Use a batch input with a cron schedule to read the file every minute.

Answer

Set crcSalt = <SOURCE> on the monitor input to ensure unique file tracking.

Answer

Set followTail = 1 on the [monitor:///opt/app/logs/current.log] stanza.

Question 15

A Splunk administrator has a Universal Forwarder installed on a Linux host. They need to monitor a directory that contains log files which are actively being written to and rotated daily with a .log extension. They want to ensure that Splunk reads the files from the beginning when they are first discovered, but does not read old rotated files that were already processed. Which configuration in inputs.conf should they use?

Accepted Answer

Set 'followTail = 0' to read from the beginning of the file on first discovery.. The requirement is to read new files from the beginning while avoiding reprocessing of already processed rotated files. Setting followTail = 0 ensures that Splunk reads from the start of the file when it is first discovered. The fishbucket tracks file states, so rotated files that have been read will not be re-ingested. Other settings like crcSalt or initCrcLength affect file identification but not the initial read position.

Answer

Set 'crcSalt = <SOURCE>' to ensure files are uniquely identified.

Answer

Set 'initCrcLength = 1024' to increase the number of bytes used for CRC calculation.

Answer

Set 'ignoreOlderThan = 7d' to skip files older than 7 days.