SPLK-1003 Splunk Admin Basics — 20 Questions

Question 1

Which Splunk component is primarily responsible for parsing and indexing incoming data streams?

Accepted Answer

Indexer. The Indexer performs the heavy lifting of processing, parsing, and storing indexed data.

Answer

Deployment Server

Answer

Universal Forwarder

Answer

Search Head

Question 2

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

Accepted Answer

splunk search "index=* sourcetype=your_type" | head 10. The 'splunk search' command allows you to verify data ingestion directly from the CLI.

Answer

splunk list inputs

Answer

splunk status

Answer

splunk show conf

Question 3

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. Another process (or a previous instance of Splunk) is likely already holding that port open.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 4

An administrator needs to change the default maximum size of an index. Which file should be modified?

Accepted Answer

indexes.conf. indexes.conf is the authoritative file for index settings including 'maxTotalDataSizeMB'.

Answer

server.conf

Answer

props.conf

Answer

limits.conf

Question 5

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. The outputs.conf file on the Universal Forwarder should contain the indexer cluster master's discovery URI to obtain the indexer list.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/manager/local/

Answer

$SPLUNK_HOME/etc/apps/search/local/

Question 6

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Accepted Answer

props.conf. This setting is defined in props.conf under the specific sourcetype stanza.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 7

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

Accepted Answer

Use a Search Head Cluster and push the bundle via the deployer.. Splunk configurations should be managed via the Deployment Server or a Configuration Management tool like Git/Ansible to ensure consistency across search heads.

Answer

Manually copy the local/savedsearches.conf file to every server.

Answer

Enable indexer discovery on all search heads.

Answer

Restart the Splunk services on all search heads.

Question 8

An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?

Accepted Answer

Settings -> Apps -> Install app from file. Apps -> Manage Apps -> Install app from file is the standard path in Splunk Web.

Answer

Settings -> Forwarder Management

Answer

Settings -> Data Inputs -> Add new

Answer

Settings -> Server Settings -> System Settings

Question 9

Which of the following is a valid method to restart the Splunk service on a Linux system?

Accepted Answer

/opt/splunk/bin/splunk restart. The standard system-level command for restarting Splunk is '/opt/splunk/bin/splunk restart'.

Answer

service splunk stop && service splunk start

Answer

/opt/splunk/bin/splunk reload

Answer

kill -9 $(pidof splunkd)

Question 10

What is the default port used by the Splunk Web interface?

Accepted Answer

8000. 8000 is the standard default port for Splunk Web.

Answer

9997

Answer

8089

Answer

443

Question 11

After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?

Accepted Answer

The app permissions in 'Manage Apps'.. If the app is installed but not visible, the user's permissions for the app or the dashboard objects are likely missing.

Answer

The server license status.

Answer

The splunkd logs for critical errors.

Answer

The indexer cluster master status.

Question 12

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

Accepted Answer

authorize.conf. Role-based access control (RBAC) allows you to restrict indexed data access via the 'srchIndexesAllowed' setting in authorize.conf.

Answer

user-prefs.conf

Answer

indexes.conf

Answer

authentication.conf

Question 13

Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?

Accepted Answer

Deployment Server. The Deployment Server is the primary mechanism for centralizing and pushing configuration updates to forwarders.

Answer

Heavy Forwarder

Answer

Indexer Cluster Master

Answer

Search Head Cluster Deployer

Question 14

You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?

Accepted Answer

props.conf. The TIME_PREFIX and TIME_FORMAT settings in props.conf determine how Splunk parses timestamps from raw logs.

Answer

indexes.conf

Answer

inputs.conf

Answer

transforms.conf

Question 15

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

Accepted Answer

transforms.conf: [setnull]. You must use transforms.conf with a regex rule and link it to props.conf to discard data at index time.

Answer

inputs.conf: [monitor://...]

Answer

outputs.conf: [tcpout]

Answer

props.conf: [default]

Question 16

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

Accepted Answer

Settings -> Access Controls -> Users. Settings -> Users provides the UI to create and modify user attributes and roles.

Answer

Settings -> Roles

Answer

Settings -> Server Settings

Answer

Settings -> Authentication Method

Question 17

Which Splunk process is responsible for the actual indexing of data on the indexer?

Accepted Answer

splunkd. Splunkd is the main daemon responsible for all core Splunk functionality, including indexing.

Answer

splunkweb

Answer

mongod

Answer

splunk-optimize

Question 18

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Accepted Answer

homePath. The 'homePath' (or 'coldPath'/'thawedPath') defines the physical location of the data on the disk.

Answer

dataDir

Answer

maxTotalDataSizeMB

Answer

indexPool

Question 19

Where are the local configuration files for an installed app located?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/local/. App-specific local configurations are located in the local/ directory within the app folder.

Answer

/var/log/splunk/

Answer

$SPLUNK_HOME/etc/system/local/

Answer

$SPLUNK_HOME/etc/apps/<app_name>/default/

Question 20

What is the primary function of the 'Indexer Cluster' feature?

Accepted Answer

To provide data replication and high availability.. Indexer Clustering provides data high availability and replication across multiple indexers.

Answer

To increase the web interface speed.

Answer

To speed up search queries across multiple head nodes.

Answer

To manage user permissions for index access.