SPLK-1003 Hard Questions — 25 Difficult Questions

Question 1

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

Accepted Answer

Both index1 and index2.. When a user inherits multiple roles, the permissions are additive — the user receives the union of all granted permissions. RoleA allows index1 and RoleB allows index2, so the user can search both index1 and index2. Splunk does not require a single role to grant all access; it merges srchIndexesAllowed across all effective roles.

Answer

Only index1.

Answer

Only index2.

Answer

No indexes.

Question 2

Which THREE parameters must be exchanged between Splunk and an Identity Provider for SAML to work?

Accepted Answer

SP Metadata XML. For SAML to work between Splunk (the Service Provider) and an Identity Provider, the SP Metadata XML (option A) must be exchanged because it contains the SP's Entity ID, Assertion Consumer Service (ACS) URL, and signing certificate needed by the IdP to validate and route assertions. The SSL Certificate (option C) is required so the IdP and SP can sign and verify SAML assertions and establish trust, typically via X.509 certificates embedded in the metadata. The Entity ID (option E) is a unique identifier for the SP that the IdP uses to recognize the relying party and match the correct SAML configuration. Option B (LDAP Bind Password) is incorrect because SAML authentication does not use LDAP binds; LDAP is a separate authentication method. Option D (Splunk license key) is irrelevant to SAML federation and is never exchanged with an IdP.

Answer

LDAP Bind Password

Answer

The Splunk license key.

Question 3

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Accepted Answer

The file sorted alphabetically by name. When two stanzas have the same precedence, Splunk resolves the conflict by sorting the configuration files alphabetically by filename and using the one that comes last (or first, depending on context—Splunk uses the file that sorts later alphabetically as higher precedence within the same directory). The correct answer as given is 'The file sorted alphabetically by name' because Splunk's configuration file precedence rules specify that within the same precedence level, files are processed in reverse alphabetical order, so the alphabetically last file wins. This deterministic rule ensures consistent behavior.

Answer

The file with the largest size

Answer

It randomly chooses one

Answer

The file created most recently

Question 4

An administrator needs to manually move a bucket to frozen state immediately for compliance reasons. What is the best method?

Accepted Answer

Update the retention policy to 0 seconds and restart.. The best method to manually move a bucket to frozen state immediately is to update the retention policy to 0 seconds and restart Splunk. This forces the bucket to roll to frozen based on the retention policy, which is a supported and safe method.

Answer

Delete the bucket folder from the OS.

Answer

Rename the bucket folder to start with 'frozen'.

Answer

Use the 'splunk edit index' command.

Question 5

An administrator receives reports that searches are returning warnings about license violations and that search has been partially restricted. The administrator wants to identify which indexers contributed the most indexing volume in the last 24 hours to determine the source of the overage. Which approach provides this information?

Accepted Answer

Run a search over the _internal index for license_usage.log events and use the splunk_server field to break down volume by indexer.. license_usage.log is written to the _internal index and records usage per reporting indexer, with splunk_server identifying the host. Searching that source and aggregating by splunk_server yields a ranked list of indexers by volume for the last 24 hours, which is the most direct way to find the hosts responsible for a license overage.

Answer

Query the license manager's REST endpoint /services/licenser/usage and aggregate results by pool name.

Answer

Inspect the indexer's metrics.log for per-sourcetype throughput and rank sourcetypes by volume.

Answer

Open the Monitoring Console License Usage view and read the Indexing Volume by Indexer panel for the last 24 hours.

Question 6

A Splunk administrator is configuring a Deployment Server to manage a large number of Universal Forwarders. The administrator notices that some forwarders are not receiving updated configurations. Upon investigation, the administrator finds that the forwarders have different 'serverName' values in server.conf than their actual hostnames. What is the most likely cause of the forwarders not receiving the updated configurations?

Accepted Answer

The Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass.. The most likely cause is that the Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass and thus will not receive the updated configurations. The serverName is the client name that the forwarder reports to the Deployment Server. If it differs from the actual hostname, any serverclass filters based on hostname will fail to match.

Answer

The Deployment Server will ignore forwarders with duplicate serverName values, causing them not to receive configurations.

Answer

The forwarders will not be able to download apps because the serverName is used to determine the app directory path.

Answer

The forwarders cannot connect to the Deployment Server because the serverName is used for authentication.

Question 7

If a search head cluster member cannot access an indexer's bucket, what should you verify first?

Accepted Answer

The replication status and indexer clustering state.. When a search head cluster member cannot access an indexer's bucket, the most likely cause is a problem with the indexer clustering or replication state, such as a bucket not being properly replicated or a peer being down. Verifying replication status and indexer clustering state ensures that buckets are searchable and available. This is the first step because it directly addresses data availability across the cluster.

Answer

The indexer's license status.

Answer

The OS version of the search head.

Answer

The search head's RAM.

Question 8

You are configuring LDAP authentication for Splunk Enterprise. You want to ensure that users are authenticated against the LDAP directory and that their group memberships are mapped to Splunk roles. Which two configuration settings must you define in authentication.conf to achieve this? (Choose two.)

Accepted Answer

groupBaseDN. To authenticate users via LDAP and map their group memberships to Splunk roles, you must specify the userBaseDN to locate user accounts and the groupBaseDN to locate groups. These settings enable Splunk to search the directory for users and groups, and then use the roleMap to assign roles based on group membership.

Answer

bindDN

Answer

srvBaseDN

Answer

roleBaseDN

Question 9

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Accepted Answer

homePath. The homePath setting in indexes.conf specifies the directory where the index's data is stored. To move the index data directory to a new partition, you must update homePath to point to the new location. This setting is critical for relocating index data.

Answer

dataDir

Answer

maxTotalDataSizeMB

Answer

indexPool

Question 10

A Splunk administrator is managing an indexer cluster with a replication factor of 3 and a search factor of 2. A peer node fails and is expected to be offline for an extended period. The administrator needs to ensure that the cluster remains searchable and that data is not lost. Which action should be taken to maintain the search factor while the peer is down?

Accepted Answer

The cluster manager will automatically fix the search factor by promoting other copies.. The cluster manager is responsible for maintaining the replication and search factors. When a peer becomes unavailable, it automatically promotes other copies to searchable status to meet the search factor, ensuring continuous searchability. This is a core feature of Splunk indexer clustering, designed to handle peer failures gracefully.

Answer

Use the CLI command 'splunk apply cluster-bundle' to redistribute buckets.

Answer

Increase the replication factor to 4 to compensate for the lost peer.

Answer

Manually copy bucket copies from the failed peer to other peers.

Question 11

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Accepted Answer

props.conf. BREAK_ONLY_BEFORE is a line-breaking/event-merging setting that belongs in props.conf under the [] or [host::] stanza. It tells the parser to start a new event only when the specified regex matches, which is essential for correctly grouping multiline events like Java stack traces or log4j entries. Because props.conf governs parsing-time behavior on the indexer (or heavy forwarder), that is the correct file.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 12

When using btool, what does the output show by default?

Accepted Answer

The merged configuration of all files. By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Answer

Only the differences from defaults

Answer

The raw file contents

Answer

Only the changes made in /local

Question 13

An administrator is troubleshooting an indexer cluster where searches are returning incomplete results. The cluster has three indexers with replication factor 2 and search factor 2. The administrator notices that one indexer is down. What is the most likely reason for incomplete search results?

Accepted Answer

The search factor is not met for some buckets.. In an indexer cluster, search factor determines how many searchable copies of each bucket exist. If an indexer goes down, buckets that had their only searchable copy on that indexer become unsearchable, leading to incomplete results. This can happen even if replication factor is met, because replication factor ensures data copies but not searchable copies. The cluster attempts to maintain search factor by making other copies searchable, but this process may take time. The most likely reason is that search factor is not met for some buckets.

Answer

The search head is not configured to search all indexers.

Answer

The indexer that is down was the master node.

Answer

The replication factor is set too low.

Question 14

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

Accepted Answer

The Splunk Instance.. In SAML authentication, the Splunk instance acts as the Service Provider (SP) — it receives SAML assertions from the Identity Provider (IdP) and grants access based on those assertions. Splunk's SAML configuration (via authentication.conf and the SAML settings in Splunk Web) defines the SP entity ID, ACS URL, and IdP metadata. The IdP is the external identity system (such as Okta, Microsoft Entra ID, or ADFS) that authenticates users and issues assertions.

Answer

The browser.

Answer

The Identity Provider (IdP).

Answer

The LDAP Server.

Question 15

A Splunk administrator is configuring a Universal Forwarder to monitor a network share on a Windows file server. The forwarder is installed on a separate Windows server and runs under the Local System account. The network share requires domain authentication. The administrator wants to ensure that the forwarder can read the files on the share. What should the administrator do?

Accepted Answer

Configure the Universal Forwarder service to log on as a domain user with read access to the share.. The Universal Forwarder service runs as Local System by default, which lacks domain credentials to access remote network shares. To read files from a network share that requires domain authentication, the service must run under a domain user account that has read permissions on the share. This is done by changing the service logon account in Windows Services. Other methods like adding Local System to share permissions or using proxy settings in inputs.conf are not valid.

Answer

Configure the forwarder to use a proxy account by setting 'proxyUser' and 'proxyPassword' in inputs.conf.

Answer

Enable 'useSSL = true' in outputs.conf to allow secure authentication to the share.

Answer

Add the Local System account to the share's permissions with read access.

Question 16

Which THREE features are associated with Indexer Clustering?

Accepted Answer

Cluster Master.. Indexer clustering in Splunk is built around a Cluster Master (A), which coordinates the cluster, manages the replication and search factors, and tells peers which buckets to replicate and search. Search affinity (B) is a clustering feature that routes searches to indexers holding the relevant replicated buckets, reducing search overhead across peers. Bucket replication (E) is the core mechanism of indexer clustering, where the replication factor determines how many copies of each bucket are maintained across peer nodes for data availability and resilience. The unmarked options do not belong: data model encryption (C) is not an indexer clustering feature, and universal forwarder load balancing (D) is a forwarding/parsing concern handled by forwarders and indexers, not by indexer clustering itself.

Answer

Data model encryption.

Answer

Universal forwarder load balancing.

Question 17

You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/bin/. Scripts used by scripted inputs should be stored in an app's bin directory, such as $SPLUNK_HOME/etc/apps/my_app/bin/. This location is on Splunk's default PATH for scripted inputs, is included in app deployment bundles, and ensures the script is available wherever the app is deployed. Placing scripts here also keeps them versioned and portable across forwarders.

Answer

$SPLUNK_HOME/var/run/

Answer

/opt/scripts/

Answer

/tmp/

Question 18

When configuring 'LDAP Strategy', what is the purpose of the 'User Base DN'?

Accepted Answer

To define the root search path for users in LDAP.. The 'User Base DN' in an LDAP strategy specifies the distinguished name (DN) of the subtree in the LDAP directory where Splunk should search for user accounts. It acts as the root search path so Splunk knows where to begin looking when binding and authenticating users. Without a correct User Base DN, Splunk cannot locate user entries and authentication fails.

Answer

To define the authentication port.

Answer

To define the administrator's password.

Answer

To specify the LDAP server IP address.

Question 19

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?

Accepted Answer

splunkd.log. splunkd.log on the indexer records connection attempts, handshakes, and errors from forwarders. It is the primary log for troubleshooting forwarder-to-indexer connectivity, including TCP connection issues, SSL negotiation, and authentication failures.

Answer

audit.log

Answer

web_service.log

Answer

metrics.log

Question 20

Which THREE items should be included in a deployment app package distributed by the Deployment Server?

Accepted Answer

inputs.conf. Apps typically contain configuration files, scripts, and potential lookup files.

Answer

indexes.conf

Answer

splunk-launch.conf