SPLK-1003 Getting Data IN And Forwarder Management Practice Test 3 — 15 Questions

Question 1

You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?

Accepted Answer

props.conf and transforms.conf. To filter sensitive data on a Heavy Forwarder before it reaches the indexer, you modify props.conf and transforms.conf. props.conf defines the stanza and references a transform, while transforms.conf contains the regex-based rules (e.g., REGEX and DEST_KEY or FORMAT) that drop or mask events/fields. This combination enables data filtering at the parsing stage on the heavy forwarder.

Answer

outputs.conf

Answer

server.conf

Answer

inputs.conf

Question 2

You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/bin/. Scripts used by scripted inputs should be stored in an app's bin directory, such as $SPLUNK_HOME/etc/apps/my_app/bin/. This location is on Splunk's default PATH for scripted inputs, is included in app deployment bundles, and ensures the script is available wherever the app is deployed. Placing scripts here also keeps them versioned and portable across forwarders.

Answer

$SPLUNK_HOME/var/run/

Answer

/opt/scripts/

Answer

/tmp/

Question 3

Which capability is exclusive to a Heavy Forwarder compared to a Universal Forwarder?

Accepted Answer

Parsing data. A Heavy Forwarder runs the full Splunk Enterprise instance and can perform parsing (index-time processing like line breaking, timestamp recognition, and field extraction via props.conf/transforms.conf) before forwarding data. A Universal Forwarder is a lightweight binary that only collects and forwards raw data — it does not parse or index. This parsing capability is the key functional differentiator between the two forwarder types.

Answer

Collecting local files

Answer

Connecting to a Deployment Server

Answer

Forwarding data

Question 4

Which protocol is the default used by Splunk Universal Forwarders to communicate with Indexers?

Accepted Answer

S2S (Splunk-to-Splunk). Splunk Universal Forwarders use the Splunk-to-Splunk (S2S) protocol by default to send data to indexers. S2S is a proprietary, secure, TCP-based protocol that operates on port 9997 and supports SSL/TLS encryption, compression, and acknowledgment. It is purpose-built for forwarding raw data and metadata between Splunk components, unlike generic protocols such as syslog or HTTP.

Answer

Syslog

Answer

HTTP

Answer

SNMP

Question 5

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 6

To ensure a Universal Forwarder is using the correct index, where is the 'index' attribute defined?

Accepted Answer

inputs.conf. For a Universal Forwarder, the `index` attribute is set in inputs.conf within the stanza that defines the data input (e.g., `[monitor:///var/log]`). This tells the forwarder which index the data should be routed to when it is sent to the indexer. If not specified, the default index (usually 'main') is used.

Answer

props.conf

Answer

outputs.conf

Answer

server.conf

Question 7

You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?

Accepted Answer

Define multiple target groups in outputs.conf and use transforms.conf to route.. Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.

Answer

Use inputs.conf to specify the destination indexer.

Answer

Configure the indexer to pull data from the forwarder.

Answer

Use a single outputs.conf with comma-separated values.

Question 8

When configuring a Deployment Client, what must be defined in deploymentclient.conf?

Accepted Answer

deploymentServer URI. The client must specify the URI and port of the Deployment Server.

Answer

The index location.

Answer

The list of indexers.

Answer

The password for the admin user.

Question 9

If you need to change the logging level of a specific component on a Universal Forwarder, which file should you edit?

Accepted Answer

log-local.cfg. log-local.cfg is the per-instance logging configuration file used to override logging levels for specific components without affecting the global log.cfg. On a Universal Forwarder, editing $SPLUNK_HOME/etc/system/local/log-local.cfg (or the app-specific copy) lets you raise or lower verbosity for a named component such as the tailing processor or the deployment client. Changes take effect after a forwarder restart or a debug refresh.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 10

What is the consequence of having the same 'serverName' in server.conf for two different Universal Forwarders?

Accepted Answer

Splunk will merge data metrics for both forwarders in internal reports.. The serverName in server.conf is used as the unique identifier for a Splunk instance in internal metrics and licensing. If two Universal Forwarders share the same serverName, Splunk cannot distinguish them, so their data metrics (such as indexing throughput and license usage) are merged and attributed to a single identity in internal reports like the license usage report.

Answer

The Indexer will block both connections.

Answer

The forwarders will immediately stop sending data.

Answer

The second forwarder will fail to start.

Question 11

What is the purpose of the 'whitelist' and 'blacklist' attributes in a serverclass.conf file?

Accepted Answer

To filter which forwarders receive the app.. In serverclass.conf, the whitelist and blacklist attributes filter which forwarders (clients) receive a given app or deployment. The whitelist specifies forwarders that should receive the app, and the blacklist excludes forwarders, based on client name, IP, or DNS pattern. This is a deployment-scoping mechanism, not a security or log-filtering feature.

Answer

To prevent unauthorized users from accessing the UI.

Answer

To filter the types of logs collected.

Answer

To limit the network bandwidth usage.

Question 12

How do you restart the Splunk service on a Linux-based Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/bin/splunk restart. The Splunk CLI provides a built-in 'restart' command invoked via the splunk binary located in $SPLUNK_HOME/bin. Running '$SPLUNK_HOME/bin/splunk restart' cleanly stops and starts the splunkd process on a Linux Universal Forwarder, preserving configuration and state. This is the officially supported method for restarting the service on any Splunk component, including UFs.

Answer

service splunk stop

Answer

kill -9 $(pgrep splunk)

Answer

reboot

Question 13

You are troubleshooting a file input that is not being ingested. You have verified the file path. Which command-line tool can show you if the file is being tracked by the monitor input?

Accepted Answer

splunk list monitor. The 'splunk list monitor' command displays all files and directories currently being monitored by the Splunk instance, including their status and any potential issues. If a file is not appearing in the output, it is not being tracked by the monitor input, which helps narrow down the problem to configuration or permissions.

Answer

splunk check files

Answer

splunk debug input

Answer

splunk show inputs

Question 14

What is the effect of setting 'autoLBFrequency' in outputs.conf on a forwarder?

Accepted Answer

Defines the interval for load balancing indexers.. The autoLBFrequency setting in outputs.conf controls how often a forwarder re-evaluates and redistributes its data streams across the configured indexer group when auto load balancing is enabled. It defines the time interval (in seconds) at which the forwarder recalculates which indexer each stream should be sent to, effectively rebalancing the load. This is distinct from connection limits or throughput caps, which are governed by other settings like maxConnections or throughput settings.

Answer

Limits the number of simultaneous connections.

Answer

Sets the maximum throughput speed.

Answer

Configures the compression ratio.

Question 15

A Universal Forwarder reports as 'missing' in the Deployment Server. What is the most common cause?

Accepted Answer

Network firewall or connectivity issue.. The most common cause of a Universal Forwarder showing as 'missing' in the Deployment Server is a network firewall or connectivity issue blocking communication on the management port (default 8089). The Deployment Server relies on the forwarder's phone-home to the deployment server; if that traffic is blocked, the forwarder appears missing.

Answer

The forwarder name is too long.

Answer

The index is full.

Answer

The license has expired.