SPLK-1003 Indexes And Data Management Practice Test 4 — 15 Questions

Question 1

Which TWO settings in indexes.conf are used to control the rotation of hot buckets?

Accepted Answer

maxHotSpanSecs. In indexes.conf, hot bucket rotation is governed by two settings: maxHotSpanSecs (B), which forces a hot bucket to roll to warm once its age exceeds the specified number of seconds, and maxDataSize (E), which forces a hot bucket to roll once it reaches the specified size (e.g., auto, auto_high_volume, or an explicit byte value). Together these control the time-based and size-based triggers for hot-to-warm rolling. frozenTimePeriodInSecs (A) controls the frozen (retention) policy for the oldest data, not hot bucket rotation. maxTotalDataSizeMB (C) sets the total index size limit that triggers freezing of the oldest buckets, not hot rotation. coldPath (D) merely specifies the directory where cold buckets are stored and has no effect on rotation.

Answer

frozenTimePeriodInSecs

Answer

maxTotalDataSizeMB

Answer

coldPath

Question 2

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 3

An administrator needs to create a new index called 'finance' on a Splunk Enterprise indexer cluster. The index must store data in a dedicated volume with a custom path. Which configuration file and stanza should be edited to define the volume?

Accepted Answer

indexes.conf, [volume:finance_volume]. To define a custom storage volume for an index, you must create a [volume:<name>] stanza in indexes.conf. This stanza specifies the path and optional size limits. The index stanza can then reference this volume via homePath or coldPath. Other files like server.conf or inputs.conf do not handle volume definitions.

Answer

indexes.conf, [finance] with path setting

Answer

server.conf, [volume:finance_volume]

Answer

inputs.conf, [volume:finance_volume]

Question 4

An administrator manages a Splunk Enterprise deployment where a critical index named 'audit_logs' must retain searchable data for 90 days. Compliance requires that after 90 days, the data must be moved to a remote NFS share for archival, but it must not be searchable in Splunk. The administrator has set frozenTimePeriodInSecs = 7776000 in indexes.conf for this index. Which additional configuration is required to ensure that buckets are archived to the remote NFS share instead of being deleted?

Accepted Answer

Set coldToFrozenDir to the NFS mount path in the index stanza.. To archive frozen buckets to a remote location, Splunk provides the coldToFrozenDir setting in indexes.conf. When a bucket reaches the frozen state, Splunk moves it to the specified directory instead of deleting it. This makes the data non-searchable but preserves it for compliance. The other options either reference invalid settings or misunderstand the bucket lifecycle.

Answer

Set coldPath to the NFS mount path and increase maxHotSpanSecs.

Answer

Set frozenTimePeriodInSecs to a higher value and configure a scripted input to copy buckets.

Answer

Set archiveOnDelete to true in the index stanza and specify a remote path.

Question 5

An administrator is configuring a new index called 'finance' on a Splunk Enterprise indexer. The index must store raw events for 90 days and then delete them permanently. The administrator sets frozenTimePeriodInSecs = 7776000 in indexes.conf under the [finance] stanza. After 90 days, the administrator notices that the data is still searchable. What is the most likely cause?

Accepted Answer

The index is configured with a coldToFrozenDir or coldToFrozenScript, causing buckets to be archived instead of deleted.. The frozenTimePeriodInSecs setting defines when buckets are eligible to be frozen, but if coldToFrozenDir or coldToFrozenScript is configured, buckets are archived instead of deleted. The administrator expects permanent deletion, but the archive configuration causes data to persist. To enforce deletion, the administrator must remove the coldToFrozenDir or coldToFrozenScript setting or manage the archive separately.

Answer

The index is configured as a summary index, which automatically extends retention beyond frozenTimePeriodInSecs.

Answer

The search head has a saved search that reindexes frozen buckets back into the index automatically.

Answer

The indexer is part of a cluster, and the cluster manager overrides frozenTimePeriodInSecs with its own retention setting.

Question 6

An administrator is configuring a new index named 'finance' in indexes.conf on a standalone Splunk Enterprise indexer. Company policy requires that no single index may store more than 100 GB of raw data on disk, and the oldest data must be removed automatically once that limit is reached. Which setting should the administrator configure to enforce this hard cap?

Accepted Answer

maxTotalDataSizeMB = 102400. A hard total-size cap on an index is enforced with maxTotalDataSizeMB in indexes.conf. When the index exceeds this value, Splunk rolls the oldest buckets to frozen, which deletes them unless a frozen archive is configured. The other settings control bucket roll size, hot/warm path limits, or time-based retention and therefore do not satisfy a 100 GB aggregate storage ceiling.

Answer

maxDataSize = 102400

Answer

frozenTimePeriodInSecs = 102400

Answer

homePath.maxDataSizeMB = 102400

Question 7

An administrator is configuring an index that receives data from a syslog receiver. The index must retain data for 90 days, but the storage team requires that the index not consume more than 500 GB of disk space. When the 500 GB limit is reached, the oldest data must be deleted. Which indexes.conf setting should be used to enforce the disk space limit?

Accepted Answer

maxTotalDataSizeMB. The requirement is to cap total index size at 500 GB and delete oldest data when exceeded. maxTotalDataSizeMB is the correct setting because it limits the total size of all buckets in the index across all paths. When the limit is reached, Splunk freezes and removes the oldest buckets, ensuring the disk space constraint is met. Other settings control retention by time or individual bucket size, not overall index size.

Answer

homePath.maxDataSizeMB

Answer

maxDataSize

Answer

frozenTimePeriodInSecs

Question 8

An administrator has a Splunk Enterprise indexer with a single index named 'web_logs'. The index is configured with maxTotalDataSizeMB = 500000 and frozenTimePeriodInSecs = 7776000. The indexer's disk volume is 1TB and currently 80% full. The administrator wants to ensure that the oldest data is frozen when the disk reaches 90% capacity, even if the time or size limits have not been reached. Which configuration change should be made?

Accepted Answer

Configure the 'volume' stanza in indexes.conf with the 'maxVolumeDataSizeMB' setting and assign the index to that volume.. The volume stanza in indexes.conf defines a storage volume and its maximum size. When the volume's data exceeds maxVolumeDataSizeMB, Splunk freezes the oldest buckets in indexes assigned to that volume. This enforces freezing based on disk capacity, independent of time or size limits. The other options either relocate data, change time-based retention, or specify an archive location, none of which trigger freezing at a specific disk threshold.

Answer

Enable 'coldToFrozenDir' to archive data to a frozen directory.

Answer

Set the 'coldPath' to a different volume with more space.

Answer

Set 'frozenTimePeriodInSecs' to a lower value to force earlier freezing.

Question 9

An administrator is planning to implement indexer clustering and needs to ensure that data is properly replicated and searchable. The cluster will have three indexers. Which TWO factors must be configured to ensure that a copy of each bucket is available for search even if one indexer fails? (Choose two.)

Accepted Answer

Search factor. To ensure data is searchable after the failure of one indexer in a three-indexer cluster, the administrator must configure both replication factor and search factor to at least 2. Replication factor controls how many copies of each bucket exist, while search factor controls how many of those copies are searchable. Together, they provide redundancy and search continuity. The other options relate to multisite clustering, forwarder configuration, or bucket lifecycle, and do not directly address the requirement.

Answer

Indexer discovery

Answer

Site replication

Answer

Bucket rolling

Question 10

A Splunk administrator is building a new index called 'web_preview' on a single indexer to ingest temporary test data. The data should be searchable immediately but must be deleted automatically after 7 days without any manual intervention. Which indexes.conf setting should the administrator configure to meet the 7-day retention requirement?

Accepted Answer

frozenTimePeriodInSecs = 604800. Age-based retention in indexes.conf is governed by frozenTimePeriodInSecs, expressed in seconds. Seven days equals 604800 seconds, so buckets older than that roll to frozen and are deleted when no frozen archive destination is configured. Size limits and hot-bucket roll settings do not enforce a time-based lifecycle, so they cannot satisfy the 7-day deletion requirement.

Answer

retirePeriodInSecs = 604800

Answer

maxTotalDataSizeMB = 604800

Answer

maxHotSpanSecs = 604800

Question 11

A Splunk administrator needs to add a new index called 'security_events' that will store data on a dedicated storage volume. The volume is already defined in indexes.conf as 'volume_security'. Which stanza and setting must be added to indexes.conf to create the index and assign it to the volume?

Accepted Answer

[security_events] with 'volume' set to 'volume_security'.. To create an index and assign it to an existing volume, you define an index stanza with the 'volume' setting pointing to the volume name. This automatically configures the index's paths based on the volume's definitions. The volume stanza itself does not list indexes; instead, indexes reference volumes. This approach centralizes path management and simplifies configuration.

Answer

[security_events] with 'path' set to the volume's path.

Answer

[security_events] with 'homePath' and 'coldPath' set to the volume's paths.

Answer

[volume_security] with 'indexes' set to 'security_events'.

Question 12

An administrator needs to configure a new index that will store data for 30 days and then delete it. The data is not required for compliance or archiving. Which setting in indexes.conf should be used to automatically delete data after 30 days?

Accepted Answer

frozenTimePeriodInSecs = 2592000. The requirement is to delete data after 30 days. The correct setting is frozenTimePeriodInSecs, which defines the age at which buckets are frozen. When a bucket is frozen, if no archiving is configured, it is deleted. Setting it to 2592000 seconds (30 days) achieves the desired retention. Other settings control size limits or bucket rolling, not time-based deletion.

Answer

maxTotalDataSizeMB = 2592000

Answer

maxDataSize = 2592000

Answer

retentionPeriod = 30

Question 13

An administrator manages a Splunk Enterprise indexer cluster with three peer nodes and a replication factor of 2. A new index named 'audit_secure' is created with search factor 1 and replication factor 2. After a peer node fails and is offline for several hours, searches against 'audit_secure' return incomplete results. Which action should the administrator take to restore full searchability of the index?

Accepted Answer

Bring the failed peer back online or replace it so the cluster can restore the searchable copies of the buckets.. In an indexer cluster, the search factor determines how many searchable copies exist and the replication factor determines how many raw copies exist. With search factor 1, only one peer holds a searchable copy of each bucket. If that peer is offline, searches are incomplete until the cluster can rebuild searchability, which requires the peer to return or be replaced. Changing settings or running search commands does not substitute for restoring peer availability.

Answer

Manually copy the bucket directories from another peer's replicated copies into the search head's index directory.

Answer

Run a search with the 'fixsearch' argument on the cluster master to force searchability across all peers.

Answer

Increase the search factor to 2 using the CLI on the master node so the cluster immediately creates additional searchable copies.

Question 14

A Splunk administrator needs to reduce the storage footprint of an index named 'app_logs' on a standalone indexer. The index currently retains data indefinitely because no retention settings are configured. The administrator wants to (1) delete data older than 90 days and (2) cap the index at 500 GB, whichever limit is reached first. Which TWO settings should the administrator configure in indexes.conf to meet these requirements? (Choose two.)

Accepted Answer

maxTotalDataSizeMB = 512000. Meeting both a 90-day age limit and a 500 GB size cap requires two settings: frozenTimePeriodInSecs for age-based freezing and maxTotalDataSizeMB for size-based freezing. Splunk freezes buckets when either limit is reached, so the oldest data is removed first. Path-specific size limits and bucket roll size settings do not enforce total index size or age-based deletion.

Answer

coldPath.maxDataSizeMB = 512000

Answer

homePath.maxDataSizeMB = 512000

Answer

maxDataSize = 512000

Question 15

An administrator is troubleshooting an indexer cluster where searches are returning incomplete results. The cluster has three indexers with replication factor 2 and search factor 2. The administrator notices that one indexer is down. What is the most likely reason for incomplete search results?

Accepted Answer

The search factor is not met for some buckets.. In an indexer cluster, search factor determines how many searchable copies of each bucket exist. If an indexer goes down, buckets that had their only searchable copy on that indexer become unsearchable, leading to incomplete results. This can happen even if replication factor is met, because replication factor ensures data copies but not searchable copies. The cluster attempts to maintain search factor by making other copies searchable, but this process may take time. The most likely reason is that search factor is not met for some buckets.

Answer

The search head is not configured to search all indexers.

Answer

The indexer that is down was the master node.

Answer

The replication factor is set too low.