SPLK-1003 Multiple Select — 20 Questions

Question 1

A Splunk administrator is planning the deployment of a new distributed environment and is documenting which responsibilities belong to the search head tier. Which two functions are performed by search heads? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Providing the interface for knowledge object management such as saved searches and dashboards. Search heads orchestrate distributed searches by dispatching map phases to indexers and merging the reduce results, and they also host the user interface plus the knowledge object store. Raw data storage belongs to indexers, data collection to forwarders, and license administration to the license manager, so those functions are excluded from the search head role.

Answer

Collecting data from endpoints and forwarding it into the pipeline

Answer

Managing the license pool and issuing license warnings to peers

Answer

Storing raw event data in buckets on disk

Question 2

You are configuring LDAP authentication for Splunk Enterprise. You want to ensure that users are authenticated against the LDAP directory and that their group memberships are mapped to Splunk roles. Which two configuration settings must you define in authentication.conf to achieve this? (Choose two.)

Accepted Answer

groupBaseDN. To authenticate users via LDAP and map their group memberships to Splunk roles, you must specify the userBaseDN to locate user accounts and the groupBaseDN to locate groups. These settings enable Splunk to search the directory for users and groups, and then use the roleMap to assign roles based on group membership.

Answer

bindDN

Answer

srvBaseDN

Answer

roleBaseDN

Question 3

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Option D is correct because the 'splunk status' CLI command queries the local splunkd process and reports whether Splunk is running, along with PID and component status, making it a standard supported method to monitor instance health. Option E is correct because the Monitoring Console app in Splunk Web provides a centralized, supported dashboard for monitoring the health, performance, and status of Splunk instances, including indexers, search heads, and forwarders. Option A is incorrect because /tmp lock files are not a documented or reliable status indicator and their presence does not reflect Splunk's operational state. Option B is incorrect because indexer cluster raw binary data (bucket files) is internal storage, not a monitoring interface, and reading it does not report instance status. Option C is incorrect because pinging a forwarder's local web port does not validate Splunk's status and forwarders typically do not run Splunk Web by default.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 4

Which TWO components must be configured on a Universal Forwarder to ensure data reaches the Indexer?

Accepted Answer

outputs.conf. On a Universal Forwarder, inputs.conf (option E) is required to define what data to collect — for example, a [monitor://] stanza specifying the file or directory to watch — so without it the forwarder has nothing to send. outputs.conf (option A) is equally required because it defines the destination indexer(s), typically via [tcpout] with server=<host>:9997 and defaultGroup settings, so the collected data knows where to go. Together these two files satisfy the forwarder's core job of reading data and forwarding it to the indexer. props.conf (option B) is optional on a forwarder and only used for parsing/sourcetype handling, not for routing data. indexes.conf (option C) is an indexer-side configuration defining index storage paths and retention, not needed on a forwarder. web.conf (option D) configures Splunk Web settings and is irrelevant to forwarding data.

Answer

props.conf

Answer

indexes.conf

Answer

web.conf

Question 5

Which TWO of the following are valid ways to configure inputs on a Universal Forwarder?

Accepted Answer

Editing inputs.conf manually. Option A is correct because inputs.conf is the primary configuration file on a Universal Forwarder, and manually editing it (typically under $SPLUNK_HOME/etc/system/local/ or an app's local directory) is a fully supported way to define inputs such as [monitor://], [tcp://], or [udp://] stanzas. Option B is correct because the 'splunk add monitor' CLI command (e.g., 'splunk add monitor /var/log') is a valid, supported method that writes the corresponding stanza into inputs.conf on the Universal Forwarder. Option C is incorrect because outputs.conf defines where the forwarder sends data (indexers, via [tcpout] settings), not what data it collects. Option D is incorrect because the Indexer UI is used for searching and managing the indexer, not for configuring inputs on a separate Universal Forwarder, which has no full web UI for input management. Option E is incorrect because the License Master API concerns license management and has nothing to do with defining data inputs on a forwarder.

Answer

Editing outputs.conf

Answer

Using the Indexer UI web interface

Answer

Using the License Master API

Question 6

Which TWO factors contribute to the 'frozen' state of a bucket?

Accepted Answer

The bucket age exceeds frozenTimePeriodInSecs.. In Splunk, a bucket becomes 'frozen' when it has aged past the frozenTimePeriodInSecs setting (Option A), meaning its data has exceeded the configured retention period and is ready to be frozen (archived or deleted). A bucket also becomes frozen when the index's total size reaches maxTotalDataSizeMB (Option C), which forces the oldest buckets to roll to frozen to keep the index within its size limit. Option B is incorrect because search head locking does not freeze buckets; search heads coordinate searches but do not control bucket lifecycle. Option D is incorrect because maxHotBuckets limits how many hot buckets can exist in an index, causing hot buckets to roll to warm, not to frozen. Option E is incorrect because license master availability affects indexing and license enforcement, not the freezing of buckets.

Answer

The bucket is locked by a search head.

Answer

The index reaches maxHotBuckets.

Answer

The license master is unreachable.

Question 7

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Option A is correct because the Universal Forwarder is a lightweight agent purpose-built to consume minimal CPU, memory, and disk resources on the source host, using a small binary with no bundled search or indexing components. Option D is correct because the Universal Forwarder does not parse or index data; it only collects, optionally compresses/encrypts, and forwards raw data (typically via TCP 9997) to a receiving indexer or heavy forwarder, where parsing and indexing occur. Option B is wrong because a Universal Forwarder can be configured with multiple outputs to send data to several indexers simultaneously, including via load balancing or an indexer cluster. Option C is wrong because the Universal Forwarder is free to download and use and does not require a Splunk Enterprise license; only the indexing/receiving side needs licensing. Option E is wrong because full parsing and indexing are performed by indexers (or heavy forwarders), not by the Universal Forwarder, which by design leaves data unparsed.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 8

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 9

A Splunk administrator needs to reduce the storage footprint of an index named 'app_logs' on a standalone indexer. The index currently retains data indefinitely because no retention settings are configured. The administrator wants to (1) delete data older than 90 days and (2) cap the index at 500 GB, whichever limit is reached first. Which TWO settings should the administrator configure in indexes.conf to meet these requirements? (Choose two.)

Accepted Answer

maxTotalDataSizeMB = 512000. Meeting both a 90-day age limit and a 500 GB size cap requires two settings: frozenTimePeriodInSecs for age-based freezing and maxTotalDataSizeMB for size-based freezing. Splunk freezes buckets when either limit is reached, so the oldest data is removed first. Path-specific size limits and bucket roll size settings do not enforce total index size or age-based deletion.

Answer

coldPath.maxDataSizeMB = 512000

Answer

homePath.maxDataSizeMB = 512000

Answer

maxDataSize = 512000

Question 10

Which THREE of the following are valid components of a Splunk license configuration?

Accepted Answer

License Slave. In a Splunk licensing architecture, a License Master (C) is the central node that manages and distributes license entitlements to the rest of the deployment, and a License Slave (A) is any Splunk instance that connects to the License Master to receive its license allocation and report usage back — both are core, valid components of a Splunk license configuration. A License Pool (E) is also a valid component: it is a logical grouping of license capacity within the License Master that lets you allocate specific license volumes to specific groups of indexers or slaves. The other options are not real Splunk licensing components: there is no 'License Forwarder' (B) — forwarders are data-shipping components, not license roles — and no 'License Alert Manager' (D); license usage alerts are configured through the License Master's monitoring console or via saved searches, not a dedicated license component.

Answer

License Forwarder

Answer

License Alert Manager

Question 11

Which TWO of the following are true regarding the Splunk Free license?

Accepted Answer

Authentication is disabled.. Option C is correct because the Splunk Free license disables user authentication, so anyone who can reach the instance is logged in automatically as the admin user and no login credentials are required. Option D is correct because Splunk Free enforces a daily indexing volume limit of 500 MB per day; once that limit is reached, indexing stops until the next day. Options A, B, and E are not part of the Free license: Splunk Free is a limited license that does not include the full set of Splunk Enterprise features, does not support multiple user roles (since authentication and role-based access control are disabled), and does not support distributed search across multiple indexers.

Answer

It includes Splunk Enterprise features.

Answer

It supports multiple user roles.

Answer

It supports distributed search.

Question 12

Which TWO locations are common places to check for configuration files on a Linux Splunk instance?

Accepted Answer

$SPLUNK_HOME/etc/system/local. Option A, $SPLUNK_HOME/etc/system/local, is correct because it is the standard directory for system-level configuration overrides that apply globally to the Splunk instance, and it takes precedence over the default settings in etc/system/default. Option B, $SPLUNK_HOME/etc/apps/[app_name]/local, is correct because app-specific local directories hold custom configuration changes for a particular app, overriding that app's default settings without affecting other apps. The remaining options are not configuration locations: $SPLUNK_HOME/bin holds Splunk's executable binaries and CLI scripts such as splunk and splunkd, $SPLUNK_HOME/var/run stores runtime state files like process IDs and the splunkd port file, and $SPLUNK_HOME/var/log contains Splunk's internal log files such as splunkd.log and metrics.log.

Answer

$SPLUNK_HOME/bin

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/var/log

Question 13

Which THREE of the following items are considered Knowledge Objects in Splunk?

Accepted Answer

Saved searches.. In Splunk, Knowledge Objects are user-created configurations that enrich, normalize, and present machine data, and Saved searches (C) qualify because they are reusable search definitions stored in Splunk that can be shared, scheduled, and used to drive other knowledge objects. Dashboards (D) are also Knowledge Objects since they are XML/JSON-defined panels and visualizations built from searches and stored in Splunk for reuse and sharing. Alerts (E) are Knowledge Objects as well, because they are saved search definitions with trigger conditions and actions that fire when results meet specified thresholds. Network cables (A) and hard drives (B) are physical hardware components, not Splunk-created knowledge artifacts, so they are not Knowledge Objects.

Answer

Network cables.

Answer

Hard drives.

Question 14

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf is correct because it defines the data inputs (monitor, TCP/UDP, scripted, etc.) that determine what data gets ingested into the indexer, including stanzas like [monitor:///var/log] with settings such as disabled, sourcetype, and index. props.conf is correct because it controls how the indexer parses and processes incoming events, setting sourcetype, line-breaking (LINE_BREAKER, SHOULD_LINEMERGE), timestamp recognition (TIME_PREFIX, TIME_FORMAT), and field extractions at index time. transforms.conf is correct because it defines the regex-based transformations and field extractions (REGEX, FORMAT, DEST_KEY) referenced by props.conf and inputs.conf, enabling routing, masking, and parsing of ingested data. server.conf is not among the three because it governs server-level settings like clustering, licensing, and general Splunk instance behavior rather than ingestion or parsing. indexes.conf is not among the three because it defines index storage properties such as path, maxDataSize, and retention, not how data is ingested or parsed.

Answer

server.conf

Answer

indexes.conf

Question 15

Which THREE factors can impact the performance of a Universal Forwarder?

Accepted Answer

Network bandwidth limits. Network bandwidth limits (B) directly affect a Universal Forwarder because it must transmit event data to the indexer over TCP port 9997, and constrained throughput causes queuing and delayed delivery. The number of active file monitors (D) impacts performance since each monitored file consumes resources for file tracking, checksumming, and reading, and many monitors increase CPU and memory usage. Disk I/O contention (E) matters because the forwarder continuously reads from monitored files and writes to its fishbucket and persistent queues, so slow or contended disks throttle ingestion. Browser type (A) is irrelevant because the Universal Forwarder has no web UI and is configured via CLI or deployment apps, and the number of logged-in users (C) does not affect the forwarder, which runs as a background service independent of interactive user sessions.

Answer

Browser type used for access

Answer

The number of users logged in

Question 16

Which THREE of the following are components of a standard Splunk architecture?

Accepted Answer

Universal Forwarder. In a standard Splunk Enterprise distributed architecture, the three core components are the Universal Forwarder (C), which collects and forwards data from source systems to the indexing tier; the Indexer (D), which receives, parses, indexes, and stores the incoming data and handles search requests against it; and the Search Head (E), which provides the user interface and distributes search requests to the indexers, consolidating and presenting the results. These three roles map directly to Splunk's documented deployment model (forwarder → indexer → search head). A Database Server (A) is not a Splunk architectural component, since Splunk uses its own proprietary index store rather than an external database, and a Web Server (B) is not a separate Splunk component because the web UI is served by the Search Head itself.

Answer

Database Server

Answer

Web Server

Question 17

Which TWO of the following are valid stanza types found in indexes.conf?

Accepted Answer

[default]. Option B, [default], is correct because indexes.conf uses a [default] stanza to define global settings that apply to all indexes unless overridden by a specific index stanza. Option E, [index_name], is correct because indexes.conf is organized around per-index stanzas, where each stanza name is the actual name of an index (for example, [main], [summary], or [my_index]) and contains that index's settings. Option A, [tcpout], is not valid in indexes.conf; tcpout stanzas belong in outputs.conf and configure forwarding destinations. Option C, [input], is not a valid indexes.conf stanza type; input stanzas are defined in inputs.conf. Option D, [source::...], is not valid in indexes.conf; source-based stanzas are used in props.conf and transforms.conf for source-type and field processing rules.

Answer

[tcpout]

Answer

[input]

Answer

[source::...]

Question 18

Which TWO of the following settings are typically found in inputs.conf?

Accepted Answer

[tcp://...]. Option A, [tcp://...], is correct because inputs.conf defines data input stanzas, and a [tcp://] stanza configures the Splunk TCP data input that listens for raw or syslog data on a given port. Option E, [monitor://...], is also correct because a [monitor://] stanza in inputs.conf tells Splunk which files or directories to watch and index, making it one of the most common input types. The unmarked options do not belong: [indexer_cluster] and [search_head] are cluster role settings configured in server.conf, while [index_retention] is not a valid inputs.conf stanza and retention is controlled via indexes.conf settings such as frozenTimePeriodInSecs.

Answer

[indexer_cluster]

Answer

[index_retention]

Answer

[search_head]

Question 19

Which TWO of the following are valid ways to resolve a license violation?

Accepted Answer

Add a new license key with higher capacity.. Option C (Add a new license key with higher capacity) is correct because a license violation occurs when indexed data volume exceeds the licensed daily quota, and installing a new license with a larger capacity directly raises that quota so the violation is resolved. Option E (Reduce the amount of data being indexed) is correct because lowering the daily indexed volume below the licensed limit eliminates the overage that triggered the violation, for example by adjusting inputs, filtering events, or dropping data. Option A (Delete the license pool) is not valid because removing a pool does not resolve a violation and can disrupt license enforcement and data ingestion. Option B (Restart the license master) is not valid because restarting the license manager does not change the licensed capacity or reduce indexed volume, so the violation would persist. Option D (Reinstall Splunk on the indexers) is not valid because reinstalling software does not alter license entitlements or the amount of data being indexed and is not a recognized remediation for a license violation.

Answer

Delete the license pool.

Answer

Restart the license master.

Answer

Reinstall Splunk on the indexers.

Question 20

An administrator is planning to implement indexer clustering and needs to ensure that data is properly replicated and searchable. The cluster will have three indexers. Which TWO factors must be configured to ensure that a copy of each bucket is available for search even if one indexer fails? (Choose two.)

Accepted Answer

Search factor. To ensure data is searchable after the failure of one indexer in a three-indexer cluster, the administrator must configure both replication factor and search factor to at least 2. Replication factor controls how many copies of each bucket exist, while search factor controls how many of those copies are searchable. Together, they provide redundancy and search continuity. The other options relate to multisite clustering, forwarder configuration, or bucket lifecycle, and do not directly address the requirement.

Answer

Indexer discovery

Answer

Site replication

Answer

Bucket rolling