SPLK-1003 Getting Data IN And Forwarder Management Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are valid ways to configure inputs on a Universal Forwarder?

Accepted Answer

Editing inputs.conf manually. Option A is correct because inputs.conf is the primary configuration file on a Universal Forwarder, and manually editing it (typically under $SPLUNK_HOME/etc/system/local/ or an app's local directory) is a fully supported way to define inputs such as [monitor://], [tcp://], or [udp://] stanzas. Option B is correct because the 'splunk add monitor' CLI command (e.g., 'splunk add monitor /var/log') is a valid, supported method that writes the corresponding stanza into inputs.conf on the Universal Forwarder. Option C is incorrect because outputs.conf defines where the forwarder sends data (indexers, via [tcpout] settings), not what data it collects. Option D is incorrect because the Indexer UI is used for searching and managing the indexer, not for configuring inputs on a separate Universal Forwarder, which has no full web UI for input management. Option E is incorrect because the License Master API concerns license management and has nothing to do with defining data inputs on a forwarder.

Answer

Editing outputs.conf

Answer

Using the Indexer UI web interface

Answer

Using the License Master API

Question 2

Which TWO components must be configured on a Universal Forwarder to ensure data reaches the Indexer?

Accepted Answer

outputs.conf. On a Universal Forwarder, inputs.conf (option E) is required to define what data to collect — for example, a [monitor://] stanza specifying the file or directory to watch — so without it the forwarder has nothing to send. outputs.conf (option A) is equally required because it defines the destination indexer(s), typically via [tcpout] with server=<host>:9997 and defaultGroup settings, so the collected data knows where to go. Together these two files satisfy the forwarder's core job of reading data and forwarding it to the indexer. props.conf (option B) is optional on a forwarder and only used for parsing/sourcetype handling, not for routing data. indexes.conf (option C) is an indexer-side configuration defining index storage paths and retention, not needed on a forwarder. web.conf (option D) configures Splunk Web settings and is irrelevant to forwarding data.

Answer

props.conf

Answer

indexes.conf

Answer

web.conf

Question 3

Which TWO of the following are true about Heavy Forwarders?

Accepted Answer

They can route data based on content.. Option B is correct because a Heavy Forwarder (HF) runs the full Splunk Enterprise instance and can inspect events with props.conf/transforms.conf to route or filter data based on content before forwarding. Option E is correct because an HF performs full parsing of data (line breaking, timestamp recognition, and field extraction) using the parsing pipeline, unlike a Universal Forwarder which only does minimal processing. Option A is wrong because HFs consume significantly more resources (CPU, memory, disk) than UFs, which are lightweight agents. Option C is wrong because HFs can be managed by a deployment server just like other forwarders. Option D is wrong because Heavy Forwarders are a current, supported component of Splunk Enterprise, not deprecated.

Answer

They consume less resources than UFs.

Answer

They cannot connect to a deployment server.

Answer

They are deprecated.

Question 4

Which TWO locations are common places to check for configuration files on a Linux Splunk instance?

Accepted Answer

$SPLUNK_HOME/etc/system/local. Option A, $SPLUNK_HOME/etc/system/local, is correct because it is the standard directory for system-level configuration overrides that apply globally to the Splunk instance, and it takes precedence over the default settings in etc/system/default. Option B, $SPLUNK_HOME/etc/apps/[app_name]/local, is correct because app-specific local directories hold custom configuration changes for a particular app, overriding that app's default settings without affecting other apps. The remaining options are not configuration locations: $SPLUNK_HOME/bin holds Splunk's executable binaries and CLI scripts such as splunk and splunkd, $SPLUNK_HOME/var/run stores runtime state files like process IDs and the splunkd port file, and $SPLUNK_HOME/var/log contains Splunk's internal log files such as splunkd.log and metrics.log.

Answer

$SPLUNK_HOME/bin

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/var/log

Question 5

Which THREE factors can impact the performance of a Universal Forwarder?

Accepted Answer

Network bandwidth limits. Network bandwidth limits (B) directly affect a Universal Forwarder because it must transmit event data to the indexer over TCP port 9997, and constrained throughput causes queuing and delayed delivery. The number of active file monitors (D) impacts performance since each monitored file consumes resources for file tracking, checksumming, and reading, and many monitors increase CPU and memory usage. Disk I/O contention (E) matters because the forwarder continuously reads from monitored files and writes to its fishbucket and persistent queues, so slow or contended disks throttle ingestion. Browser type (A) is irrelevant because the Universal Forwarder has no web UI and is configured via CLI or deployment apps, and the number of logged-in users (C) does not affect the forwarder, which runs as a background service independent of interactive user sessions.

Answer

Browser type used for access

Answer

The number of users logged in

Question 6

Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?

Accepted Answer

The Deployment Server checks against server classes.. When a Universal Forwarder is added to a Deployment Server, the forwarder initiates a phone-home request (D) to the deployment server on port 8089, which is how the server learns the client exists and begins managing it. The Deployment Server then checks against server classes (A), evaluating the client's hostname, IP, or other attributes against the configured serverclass.conf filters to determine which server classes it matches. Based on those matches, the forwarder downloads assigned app bundles (E) from the deployment server and installs them locally. Option B is incorrect because adding a forwarder to a deployment server never triggers an OS reboot. Option C is incorrect because the indexer does not automatically index any app; indexing is driven by data inputs and forwarding configuration, not by deployment server membership.

Answer

The forwarder automatically reboots the OS.

Answer

The indexer automatically indexes the app.

Question 7

An administrator needs to monitor a local text file on a Windows server and send the data to a Splunk indexer. Which component is the most efficient choice for this task?

Accepted Answer

Universal Forwarder. The Universal Forwarder is designed for minimal resource consumption when collecting data and forwarding it to an indexer.

Answer

Deployment Server

Answer

Heavy Forwarder

Answer

Splunk Light

Question 8

A Splunk administrator has configured a Deployment Server to manage forwarders. Which file on the forwarder must be configured to establish communication with the Deployment Server?

Accepted Answer

deploymentclient.conf. The deploymentclient.conf file on the universal forwarder specifies the Deployment Server's hostname/IP and management port (default 8089), enabling the forwarder to phone home and receive apps and configuration. Without this file, the forwarder has no knowledge of the Deployment Server.

Answer

inputs.conf

Answer

outputs.conf

Answer

serverclass.conf

Question 9

Which of the following is a primary reason to choose a Heavy Forwarder over a Universal Forwarder?

Accepted Answer

Ability to perform index-time parsing. A primary reason to choose a Heavy Forwarder over a Universal Forwarder is the ability to perform index-time parsing. Heavy Forwarders can parse, filter, and transform data (using props.conf/transforms.conf) before forwarding, whereas Universal Forwarders primarily forward raw data with minimal processing. This makes Heavy Forwarders suitable for data reduction and routing.

Answer

Easier installation

Answer

Native indexing capability

Answer

Lower CPU utilization

Question 10

You have configured a serverclass in serverclass.conf on the Deployment Server. Which action is required to ensure that the forwarders receive the new configuration?

Accepted Answer

Run the reload deploy-server command. After updating configuration files on the Deployment Server, you must either wait for the poll interval or trigger a reload of the deployment server configuration.

Answer

...

Answer

Update outputs.conf on the client

Answer

Restart the forwarder service

Answer

Modify the indexer's inputs.conf

Question 11

An administrator needs to monitor a script output every 60 seconds. Which configuration in inputs.conf is correct for a scripted input?

Accepted Answer

[script://./bin/myscript.sh] interval = 60. In Splunk's inputs.conf, a scripted input stanza is defined using the [script://<path>] syntax, and the polling frequency is controlled by the 'interval' attribute, specified in seconds. Setting interval = 60 causes Splunk to execute the script every 60 seconds and index its stdout. This is the canonical, documented configuration for scheduled scripted inputs on both forwarders and indexers.

Answer

[script] path = ./bin/myscript.sh, time = 60

Answer

[script://./bin/myscript.sh] frequency = 60

Answer

[script://./bin/myscript.sh] exec_time = 60

Question 12

A Splunk administrator manages 200 Universal Forwarders with a Deployment Server. A new monitoring stanza must be pushed to all forwarders. The admin edits an app in $SPLUNK_HOME/etc/deployment-apps/ and then runs the CLI command to reload the deployment server configuration. Which CLI command must be executed on the Deployment Server to apply the changes immediately without restarting Splunk?

Accepted Answer

splunk reload deploy-server. To immediately apply changes to deployment apps on a Deployment Server, the administrator runs 'splunk reload deploy-server'. This command causes the Deployment Server to re-read serverclass.conf and the deployment-apps directory, then update the list of apps offered to forwarders. Forwarders pick up changes on their next phone-home interval, which is controlled by the polling interval in the forwarder's deployment client configuration.

Answer

splunk refresh deploy-apps

Answer

splunk apply serverclass

Answer

splunk restart

Question 13

A Splunk administrator is configuring a Universal Forwarder to monitor a directory that contains log files rotated daily. The administrator wants to ensure that only files with a .log extension are ingested and that files older than 7 days are ignored. Which configuration in inputs.conf accomplishes this?

Accepted Answer

[monitor:///var/log/myapp] whitelist = \.log$ ignoreOlderThan = 7d. The correct configuration uses whitelist to include only .log files and ignoreOlderThan to skip files older than 7 days. whitelist filters based on filename, while ignoreOlderThan uses the file's modification time to exclude stale files. Together, they ensure only recent .log files are ingested, meeting both conditions efficiently.

Answer

[monitor:///var/log/myapp] whitelist = \.log$ blacklist = \.(\d{8})$

Answer

[monitor:///var/log/myapp] blacklist = \.log$ ignoreOlderThan = 7d

Answer

[monitor:///var/log/myapp] whitelist = \.log$ followTail = 0

Question 14

A Splunk administrator is configuring a Universal Forwarder to send data to an indexer cluster. The forwarder must use SSL/TLS for encryption and authenticate the indexers. The administrator has obtained the CA certificate and the forwarder's certificate and private key. Which configuration file on the Universal Forwarder should be modified to enable SSL and specify the certificate paths?

Accepted Answer

outputs.conf. To enable SSL/TLS for a Universal Forwarder sending data to indexers, the outputs.conf file must be configured. It includes stanzas for specifying the indexer destinations and SSL parameters such as sslCertPath, sslRootCAPath, and sslVerifyServerCert. This ensures encrypted communication and mutual authentication. Other configuration files like inputs.conf, server.conf, and web.conf serve different purposes and do not control outbound forwarding SSL settings.

Answer

inputs.conf

Answer

web.conf

Answer

server.conf

Question 15

A Splunk administrator is configuring a Universal Forwarder to send data to an indexer cluster. The administrator wants to ensure that the forwarder can continue to send data if the primary indexer becomes unavailable, and that data is load-balanced across multiple indexers. Which configuration should be implemented?

Accepted Answer

Configure outputs.conf with a [tcpout] stanza that lists multiple indexers in the server attribute and set autoLB = true.. To achieve both load balancing and failover, the forwarder must have multiple indexers listed in the server attribute and autoLB set to true. This allows the forwarder to distribute data across all indexers and continue sending if one fails. The other options either lack multiple indexers, disable load balancing, or use separate output groups that do not provide the needed redundancy.

Answer

Configure outputs.conf with multiple [tcpout] stanzas, each with a single server, and set useACK = true.

Answer

Configure outputs.conf with a [tcpout] stanza that lists multiple indexers in the server attribute and set autoLB = false.

Answer

Configure outputs.conf with a single [tcpout] stanza containing one server entry and set autoLB = true.