SPLK-1003 Splunk Admin Basics — 40 Questions

Question 1

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

splunk search "index=* sourcetype=your_type" | head 10. The 'splunk search' command allows you to run a search from the CLI. By searching for the specific sourcetype and limiting to 10 results, you can quickly verify if any data is being ingested for that sourcetype. This directly checks the indexed data, which is the most reliable way to confirm ingestion.

Answer

splunk list inputs

Answer

splunk status

Answer

splunk show conf

Question 2

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

Accepted Answer

Use a Search Head Cluster and push the bundle via the deployer.. In a Search Head Cluster (SHC), knowledge objects such as saved searches are managed centrally and distributed to all cluster members via the deployer using configuration bundles. The deployer pushes the bundle to the cluster captain, which then replicates it to all members, ensuring consistent knowledge objects across every Search Head. This is the officially recommended and supported method for synchronizing saved searches in a distributed environment.

Answer

Manually copy the local/savedsearches.conf file to every server.

Answer

Enable indexer discovery on all search heads.

Answer

Restart the Splunk services on all search heads.

Question 3

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

Accepted Answer

transforms.conf: [setnull]. Index-time filtering that drops events entirely is implemented with a transforms.conf stanza using the setnull action, referenced from props.conf via the TRANSFORMS-<class> setting. The [setnull] stanza name is a conventional example; the key is that transforms.conf defines the REGEX and DEST_KEY = queue with FORMAT = nullQueue to route matching events to the null queue, discarding them before indexing. This is the standard Splunk method to prevent specific events (e.g., from a given IP) from being stored.

Answer

inputs.conf: [monitor://...]

Answer

outputs.conf: [tcpout]

Answer

props.conf: [default]

Question 4

An administrator needs to increase the number of search results displayed in a dashboard panel. Where can this limit be adjusted?

Accepted Answer

limits.conf. The number of search results displayed in a dashboard panel is controlled by the 'maxresults' or 'max_count' settings in limits.conf, specifically under the [searchresults] or [search] stanza. Administrators adjust limits.conf to change the default cap on results returned to a panel, which is a server-side limit that applies across dashboards and searches.

Answer

props.conf

Answer

authorize.conf

Answer

savedsearches.conf

Question 5

Which TWO of the following directories are used to store Splunk configuration files?

Accepted Answer

/default/. In Splunk's configuration directory structure, each app or add-on under $SPLUNK_HOME/etc/apps (or the system default at $SPLUNK_HOME/etc/system) contains a /default/ directory that holds the app's shipped, baseline configuration files such as .conf stanzas, which is why option B is correct. The same structure includes a /local/ directory that stores user- or admin-created configuration files and overrides, which take precedence over /default/ at runtime, making option E correct. These two directories are the standard precedence layers Splunk merges when loading configuration. By contrast, /var/ (A) is a general Linux filesystem location for variable data and not a Splunk config layer, /etc/ (C) is the OS-level configuration directory rather than Splunk's app config structure, and /bin/ (D) holds executable binaries, not configuration files.

Answer

/var/

Answer

/etc/

Answer

/bin/

Question 6

Which TWO of the following are true regarding Indexer Clustering?

Accepted Answer

It allows search heads to search across all indexers.. Option A is correct because Indexer Clustering is designed so that search heads can distribute searches across all peer indexers in the cluster, providing a unified search experience over the clustered data. Option D is correct because an indexer cluster requires a master node (also called the cluster manager) to coordinate replication, manage bucket fixup, and maintain the cluster's replication and search factors. The unmarked options are incorrect: forwarders are still needed to send data into the cluster (B), Splunk software installation is not automated by clustering (C), and the master node coordinates the cluster rather than performing indexing itself—indexing is done by the peer nodes (E).

Answer

It eliminates the need for any forwarders.

Answer

It automatically handles the installation of Splunk software.

Answer

The Master node performs the actual indexing.

Question 7

A Splunk administrator is configuring a new index that will receive data from a high-volume application. The administrator wants to ensure that the index is stored on a dedicated volume and that the data is replicated across the indexer cluster for fault tolerance. Which configuration settings must be specified in indexes.conf on the indexers?

Accepted Answer

homePath, coldPath, and the cluster's replication factor and search factor are configured at the cluster level, not in indexes.conf.. The index's storage location is defined by homePath and coldPath in indexes.conf. Replication and search factors are cluster-wide settings configured on the master node or in server.conf, not per index. Thus, the administrator must set the paths in indexes.conf and verify the cluster's replication and search factors are appropriate for fault tolerance.

Answer

repFactor and searchFactor

Answer

homePath, coldPath, and frozenTimePeriodInSecs

Answer

homePath and coldPath

Question 8

A Splunk administrator wants to onboard data from a custom application that writes a new log file each hour with a unique filename, such as app-2025-01-15-14.log. The files are rotated daily and old files are never deleted. The administrator needs to ensure that Splunk ingests both existing and future files without consuming excessive file handles. Which input stanza type should be used in inputs.conf?

Accepted Answer

[monitor:///var/log/app/app-*.log]. A monitor stanza with a wildcard path is the standard way to continuously ingest files that match a pattern, including newly created ones. It handles file rotation and does not need per-file configuration, making it the correct choice for hourly application logs that must be indexed as they appear.

Answer

[fschange:///var/log/app/]

Answer

[script:///var/log/app/app-*.log]

Answer

[batch:///var/log/app/]

Question 9

A Splunk administrator has installed a new app on a search head. Users report that the app's dashboards and saved searches do not appear when they log in, even though the app appears in the Apps menu. The administrator confirms the app is enabled globally. Which setting in app.conf should be checked to ensure the app's navigation and views are visible to all users?

Accepted Answer

state = enabled and visible = true in the [ui] stanza. The [ui] stanza in app.conf controls the app's visibility and state in the Splunk Web interface. Setting state = enabled activates the app, and visible = true ensures its dashboards, saved searches, and navigation are accessible to users. If visible is set to false, the app remains installed but its UI elements are hidden, which matches the reported symptoms.

Answer

version = 1.0 in the [launcher] stanza

Answer

is_configured = 1 in the [install] stanza

Answer

label = <App Name> in the [package] stanza

Question 10

A Splunk administrator is configuring a search head cluster to improve search performance and availability. Which two components are required for a search head cluster to function? (Choose two.)

Accepted Answer

Captain. A search head cluster requires a deployer to distribute configurations and a captain to coordinate cluster activities. The deployer ensures that all members have consistent apps and settings, while the captain manages search scheduling and artifact replication. Other components like cluster manager or license manager are not part of the search head cluster architecture.

Answer

License manager

Answer

Cluster manager

Answer

Indexer cluster manager

Question 11

A Splunk administrator needs to confirm which license group is currently active on a standalone indexer before onboarding additional data sources. Which CLI command should the administrator run on the indexer to display the active license group?

Accepted Answer

splunk show license. The splunk show license command is the supported CLI method for viewing the active license group, stack, and expiration on a Splunk Enterprise instance. Because licensing governs how much data the indexer may ingest, verifying the group before onboarding sources prevents unexpected license violations. The other commands either do not exist or report unrelated process or pool information.

Answer

splunk list licenser

Answer

splunk status --license

Answer

splunk display license-usage

Question 12

A Splunk administrator needs to ensure that a Universal Forwarder continues to send data to an indexer even if the indexer becomes temporarily unavailable. The administrator wants the forwarder to buffer data and retry sending when the indexer is back online. Which setting in outputs.conf should be configured to enable this behavior?

Accepted Answer

persistentQueueSize = <size> in the [tcpout] stanza. The persistentQueueSize setting in outputs.conf creates a disk-based buffer that holds events when the forwarder cannot reach the indexer. This allows the forwarder to accumulate data during an outage and send it once the indexer is back online. Without this setting, events may be dropped when the network or indexer is down.

Answer

sslCertPath = <path> in the [tcpout] stanza

Answer

autoLB = true in the [tcpout] stanza

Answer

useACK = true in the [tcpout] stanza

Question 13

A Splunk administrator needs to ensure that all search activity performed by users in the 'security' role is audited, including the search strings they run. The administrator wants to capture this information without deploying any additional apps. Which built-in Splunk capability should be enabled and configured to accomplish this?

Accepted Answer

Configure the search head to log searches to an index by enabling 'search_audit' in the appropriate configuration file.. To capture search activity, including search strings, Splunk Enterprise provides a search audit feature. When enabled, it logs searches to an index, typically the _audit index. This is configured by setting search_audit to true in the [audit] stanza of server.conf. This built-in capability requires no additional apps and directly fulfills the requirement. The other options either do not capture search strings or misconfigure the setting.

Answer

Enable audit logging by setting 'auditTrail' in server.conf and configure the audit index.

Answer

Enable the 'search_audit' setting in indexes.conf to log searches to the _audit index.

Answer

Use the 'audit' command in a scheduled search to capture search activity from the _internal index.

Question 14

A Splunk administrator is configuring a new indexer to join an existing indexer cluster. The administrator needs to ensure that the indexer can communicate with the cluster master and receive configuration updates. Which TWO settings must be configured in server.conf on the new indexer? (Choose two.)

Accepted Answer

mode = slave in the [clustering] stanza. To join an indexer cluster, an indexer must specify the cluster master's address via master_uri and set its mode to slave (or peer) in server.conf. These settings enable the indexer to connect to the master and assume its role in the cluster. Other settings like replication_factor and search_factor are defined on the master.

Answer

replication_factor = <number> in the [clustering] stanza

Answer

pass4SymmKey = <key> in the [clustering] stanza

Answer

search_factor = <number> in the [clustering] stanza

Question 15

A Splunk administrator needs to configure a forwarder to send data to multiple indexers for load balancing and high availability. The administrator wants to ensure that if one indexer becomes unavailable, the forwarder automatically sends data to another available indexer. Which outputs.conf configuration should be used?

Accepted Answer

Define a [tcpout:my_indexers] stanza with 'server = indexer1:9997,indexer2:9997' and set 'autoLB = true'.. To configure load balancing and failover, you define a target group in outputs.conf with a list of indexers and set autoLB = true. This enables the forwarder to distribute data across the indexers and automatically switch to another if one fails. The correct syntax uses a named stanza like [tcpout:my_indexers]. Other options use invalid settings or omit the necessary group structure.

Answer

Use a [tcpout] stanza with a comma-separated list of indexers in the 'server' setting, and enable 'autoLoadBalancing'.

Answer

Define a [tcpout:my_indexers] stanza with 'server = indexer1:9997,indexer2:9997' and set 'loadBalance = true'.

Answer

Use a [tcpout] stanza with 'server = indexer1:9997,indexer2:9997' and set 'autoLB = true' without a target group.

Question 16

A Splunk administrator is configuring a deployment server to manage a large number of universal forwarders. The administrator wants to ensure that the forwarders are properly assigned to server classes and receive the correct configurations. Which TWO of the following are true regarding the deployment server and its configuration? (Choose two.)

Accepted Answer

A deployment client can belong to multiple server classes, and it will receive the union of all configurations from those classes.. The deployment server uses serverclass.conf to define server classes and map clients based on filters. Clients can belong to multiple server classes and receive merged configurations. The other options are false because phoneHomeIntervalInSecs is set on the client, deployment clients must be configured with the deployment server address but not necessarily in deploymentclient.conf, and the deployment server can deploy to universal forwarders.

Answer

The deployment server uses the 'phoneHomeIntervalInSecs' setting in serverclass.conf to control how often clients check for updates.

Answer

The deployment server can deploy configurations to indexers and search heads, but not to universal forwarders.

Answer

The deployment server requires that all deployment clients be configured with the deployment server's IP address and port in deploymentclient.conf.

Question 17

A Splunk administrator is reviewing the default filesystem layout of a Splunk Enterprise installation on a Linux host to plan backups and configuration management. Which two directories are part of the default installation structure? (Choose two.)

Accepted Answer

$SPLUNK_HOME/var/lib. The default Splunk Enterprise installation includes etc for configuration and var/lib for index data. These two directories are fundamental for administration: etc governs behavior and var/lib stores indexed events. The other paths either do not exist by default or misplace standard content, such as licensing under etc/licenses and scripted inputs within app bin directories.

Answer

$SPLUNK_HOME/share/splunk/plugins

Answer

$SPLUNK_HOME/bin/scripts

Answer

$SPLUNK_HOME/license

Question 18

Which Splunk component is primarily responsible for parsing and indexing incoming data streams?

Accepted Answer

Indexer. The indexer is the Splunk component that receives incoming data streams, parses them (applies line breaking, timestamp recognition, and sourcetype-based field extraction), and writes the resulting events into index buckets. Parsing and indexing are the indexer's core functions — forwarders only collect and forward, while search heads only query indexed data.

Answer

Deployment Server

Answer

Universal Forwarder

Answer

Search Head

Question 19

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. The most likely cause is that another process is already using port 9997. When Splunkd tries to bind to a port that is already in use, it fails to start or fails to listen on that port. This is a common issue when multiple instances or other applications are running on the same host.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 20

An administrator needs to change the default maximum size of an index. Which file should be modified?

Accepted Answer

indexes.conf. indexes.conf is the configuration file that defines index properties, including maxTotalDataSizeMB (the maximum size of an index) and frozenTimePeriodInSecs (retention). To change the default maximum size of an index, you modify the relevant index stanza in indexes.conf (typically in $SPLUNK_HOME/etc/system/local/ or an app). The setting maxTotalDataSizeMB controls the total disk footprint before the oldest buckets are frozen.

Answer

server.conf

Answer

props.conf

Answer

limits.conf