SPLK-1003 Multiple Select — 50 Questions

Question 1

Which TWO actions should be taken before manually moving an index to a new storage volume?

Accepted Answer

Verify the file system permissions of the new path.. You must stop the Splunk service and ensure the filesystem permissions are correct for the new directory.

Answer

Modify the indexes.conf file.

Answer

Clear the license master cache.

Answer

Delete the existing index.

Question 2

Which TWO of the following are valid ways to define field extractions?

Accepted Answer

Using the EXTRACT- prefix in props.conf. Field extractions can be defined using inline regex in props.conf or via transforms.conf.

Answer

Directly in inputs.conf

Answer

Using the INDEXED-EXTRACTION attribute in transforms.conf

Answer

Using a CSV file in etc/system/local

Question 3

Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?

Accepted Answer

The Deployment Server checks against server classes.. The forwarder handshakes, downloads app bundles, and restarts/reloads as configured.

Answer

The forwarder automatically reboots the OS.

Answer

The indexer automatically indexes the app.

Question 4

Which THREE of the following are true regarding license usage monitoring?

Accepted Answer

Usage can be viewed via the Splunk Web UI.. Monitoring can be done via the UI, the REST API, or by querying internal logs.

Answer

Usage must be calculated manually from event count.

Answer

License usage is only available to the splunk-system-user.

Question 5

Which TWO of the following are true about the 72-hour grace period?

Accepted Answer

It disables indexing after 72 hours.. The 72-hour grace period applies when a slave cannot reach the master; it is not a violation in the 30-day window sense.

Answer

It allows the admin to search during the period.

Answer

It only applies to trial licenses.

Answer

It counts as a license violation.

Question 6

Which THREE of the following items are considered 'license slaves'?

Accepted Answer

Standalone instances. Only indexers and search heads (that perform indexing) are typically categorized as slaves in this context; heavy forwarders are not.

Answer

Universal Forwarders

Answer

Deployment Servers

Question 7

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Universal forwarders perform no parsing and have a minimal footprint.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 8

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Monitoring can be done via the CLI 'splunk status' or the Monitoring Console in the GUI.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 9

Which TWO of the following actions occur when a Splunk license violation is active?

Accepted Answer

Splunk continues to index data.. During a violation, indexing continues, but the ability to perform searches is impacted according to the rules of the violation.

Answer

All user accounts are locked.

Answer

Data ingestion is blocked immediately.

Answer

The license key is automatically deleted.

Question 10

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. btool is a utility for viewing, checking, and debugging configuration files.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service

Question 11

Which TWO of the following are valid stanza types found in indexes.conf?

Accepted Answer

[default]. indexes.conf uses index names as stanzas, and [default] for global settings.

Answer

[tcpout]

Answer

[input]

Answer

[source::...]

Question 12

Which TWO settings are required to enable cold-to-frozen archiving?

Accepted Answer

coldToFrozenDir. To enable archiving, you must define the coldToFrozenScript and ensure the path for frozen data exists.

Answer

frozenPath

Answer

maxFrozenSize

Answer

enableArchive = true

Question 13

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 14

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf, props.conf, and transforms.conf form the core of data processing.

Answer

server.conf

Answer

indexes.conf

Question 15

Which TWO locations are common places to check for configuration files on a Linux Splunk instance?

Accepted Answer

$SPLUNK_HOME/etc/system/local. Configurations reside in system/local or app/local directories.

Answer

$SPLUNK_HOME/bin

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/var/log

Question 16

Which TWO settings in indexes.conf are used to control the rotation of hot buckets?

Accepted Answer

maxHotSpanSecs. maxDataSize and maxHotSpanSecs are the two primary parameters that determine when a bucket should roll from hot to warm.

Answer

frozenTimePeriodInSecs

Answer

maxTotalDataSizeMB

Answer

coldPath

Question 17

Which TWO methods can be used to monitor the disk usage of an index?

Accepted Answer

Settings > Data > Indexes page.. The Splunk GUI provides a dashboard and the CLI provides 'splunk list indexes' to view status.

Answer

Running a search on _audit.

Answer

Viewing the license_usage.log.

Answer

Checking the web.conf file.

Question 18

Which THREE of the following represent true statements about the 'transforms.conf' file?

Accepted Answer

It is used to perform data masking or anonymization. transforms.conf is used for complex extractions, routing, and anonymization.

Answer

It is the primary file for setting up TCP inputs

Answer

It is used to define the sourcetype of data

Question 19

Which TWO of the following are valid ways to resolve a license violation?

Accepted Answer

Add a new license key with higher capacity.. A violation can be resolved by increasing the quota via a new key or reducing the data ingestion volume.

Answer

Delete the license pool.

Answer

Restart the license master.

Answer

Reinstall Splunk on the indexers.

Question 20

Which TWO of the following are true regarding the Deployment Server?

Accepted Answer

It manages configurations for deployment clients.. The DS distributes apps to deployment clients and keeps them in sync.

Answer

It can only manage forwarders on the same subnet.

Answer

It is a required component for all Splunk deployments.

Answer

It is responsible for indexing raw logs.