SPLK-1003 Timed Hard Questions — 25 Difficult Questions

Question 1

A user reports that their search is failing to return data from 3 years ago, even though the retention policy is set to 5 years. What is the most likely cause?

Accepted Answer

The index reached the maxTotalDataSizeMB limit.. The frozenTimePeriodInSecs is the primary retention limit; if it is set correctly, check the maxTotalDataSizeMB, which might trigger rolling to frozen earlier if the disk fills up.

Answer

The buckets are in the warm state.

Answer

The index is corrupted.

Answer

The user does not have read access to the cold bucket.

Question 2

A bucket in the 'warm' state is currently locked. What process is likely happening?

Accepted Answer

The bucket is being rolled.. During bucket rolling (from hot to warm or warm to cold), the bucket is temporarily locked to ensure data integrity during the file system move.

Answer

The bucket is being searched.

Answer

The bucket is being indexed.

Answer

The bucket is undergoing a summary rebuild.

Question 3

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Accepted Answer

The file sorted alphabetically by name. When precedence is tied, Splunk uses a deterministic method based on the filename, sorting alphabetically.

Answer

The file with the largest size

Answer

It randomly chooses one

Answer

The file created most recently

Question 4

An administrator needs to manually move a bucket to frozen state immediately for compliance reasons. What is the best method?

Accepted Answer

Update the retention policy to 0 seconds and restart.. The 'splunk enable/disable/remove' commands don't support manual freezing; the 'splunk revert' or manual bucket removal is not supported, but modifying the frozenTimePeriodInSecs is the formal way to trigger a policy change.

Answer

Delete the bucket folder from the OS.

Answer

Rename the bucket folder to start with 'frozen'.

Answer

Use the 'splunk edit index' command.

Question 5

You want to prevent an index from growing beyond 10,000,000 events. Which setting is appropriate?

Accepted Answer

It is not possible to limit by event count via indexes.conf.. maxTotalDataSizeMB is for size, but maxHotSpanSecs or other settings do not limit by event count. However, maxWarmDBCount and maxHotBuckets can influence retention, but there is no direct 'maxEventCount' setting in indexes.conf. Therefore, you must use a scripted approach or external monitoring. Wait—actually, checking the docs, there is no event count limit. The best answer is that it cannot be done via indexes.conf.

Answer

maxTotalDataSizeMB

Answer

maxEventCount

Answer

maxBuckets

Question 6

Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?

Accepted Answer

The Deployment Server checks against server classes.. The forwarder handshakes, downloads app bundles, and restarts/reloads as configured.

Answer

The forwarder automatically reboots the OS.

Answer

The indexer automatically indexes the app.

Question 7

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

Accepted Answer

transforms.conf: [setnull]. You must use transforms.conf with a regex rule and link it to props.conf to discard data at index time.

Answer

inputs.conf: [monitor://...]

Answer

outputs.conf: [tcpout]

Answer

props.conf: [default]

Question 8

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

Accepted Answer

Use a Search Head Cluster and push the bundle via the deployer.. Splunk configurations should be managed via the Deployment Server or a Configuration Management tool like Git/Ansible to ensure consistency across search heads.

Answer

Manually copy the local/savedsearches.conf file to every server.

Answer

Enable indexer discovery on all search heads.

Answer

Restart the Splunk services on all search heads.

Question 9

Which TWO of the following are true about the 72-hour grace period?

Accepted Answer

It disables indexing after 72 hours.. The 72-hour grace period applies when a slave cannot reach the master; it is not a violation in the 30-day window sense.

Answer

It allows the admin to search during the period.

Answer

It only applies to trial licenses.

Answer

It counts as a license violation.

Question 10

A Splunk administrator observes that the license master is reporting an 'indexer-slave' mismatch. Which configuration file should the admin check on the license slave?

Accepted Answer

server.conf. The slave's connection to the master is defined in the [license] stanza of server.conf.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 11

Which TWO of the following actions occur when a Splunk license violation is active?

Accepted Answer

Splunk continues to index data.. During a violation, indexing continues, but the ability to perform searches is impacted according to the rules of the violation.

Answer

All user accounts are locked.

Answer

Data ingestion is blocked immediately.

Answer

The license key is automatically deleted.

Question 12

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. btool is a utility for viewing, checking, and debugging configuration files.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service

Question 13

Which THREE items should be included in a deployment app package distributed by the Deployment Server?

Accepted Answer

inputs.conf. Apps typically contain configuration files, scripts, and potential lookup files.

Answer

indexes.conf

Answer

splunk-launch.conf

Question 14

An administrator has configured a License Pool and assigned specific indexers to it. However, the indexers are still consuming from the 'default' pool. What is the most likely cause?

Accepted Answer

The license_pool attribute in server.conf was not mapped correctly to the License Master.. The license pool configuration requires the indexers to be explicitly configured to point to the License Master, and the License Master must be aware of the specific pool assignment for those slaves.

Answer

License pools only apply to search heads.

Answer

The indexers have not been restarted.

Answer

The indexers are using a trial license.

Question 15

You need to ensure that a specific app deployed via Deployment Server overwrites local configurations on the client. What is the correct way to handle this?

Accepted Answer

Use the 'restartSplunkd = true' attribute in serverclass.conf.. App precedence is managed by directory hierarchy; app directory content is overwritten by local configuration in some cases, but specifically, you use the 'restart' or 'reload' attributes in serverclass.conf, and deployment server overrides are controlled by file precedence.

Answer

Use the 'override = true' flag in inputs.conf.

Answer

Use the 'priority' attribute in serverclass.conf.

Answer

Manually delete the local files.

Question 16

You have configured a serverclass in serverclass.conf on the Deployment Server. Which action is required to ensure that the forwarders receive the new configuration?

Accepted Answer

Run the reload deploy-server command. After updating configuration files on the Deployment Server, you must either wait for the poll interval or trigger a reload of the deployment server configuration.

Answer

...

Answer

Update outputs.conf on the client

Answer

Restart the forwarder service

Answer

Modify the indexer's inputs.conf

Question 17

When setting up a License Master in a distributed environment, what is the recommended practice for the License Master role?

Accepted Answer

Dedicate an instance to act as the License Master.. The License Master should be a dedicated instance (or a primary instance) to ensure license availability and accurate reporting.

Answer

Co-locate it with a Search Head.

Answer

Co-locate it with a heavy forwarder.

Answer

Assign it to a standalone Indexer.

Question 18

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Accepted Answer

The System/local value. System/local has a higher precedence than App/default.

Answer

The App/default value

Answer

The app with the highest priority in app.conf

Answer

They are merged alphabetically

Question 19

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 20

When using btool, what does the output show by default?

Accepted Answer

The merged configuration of all files. By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Answer

Only the differences from defaults

Answer

The raw file contents

Answer

Only the changes made in /local