A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?
You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?
An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?
A Splunk administrator is configuring a new index that will receive data from a high-volume application. The administrator wants to ensure that the index is stored on a dedicated volume and that the data is replicated across the indexer cluster for fault tolerance. Which configuration settings must be specified in indexes.conf on the indexers?
A Splunk administrator wants to onboard data from a custom application that writes a new log file each hour with a unique filename, such as app-2025-01-15-14.log. The files are rotated daily and old files are never deleted. The administrator needs to ensure that Splunk ingests both existing and future files without consuming excessive file handles. Which input stanza type should be used in inputs.conf?
A Splunk administrator has installed a new app on a search head. Users report that the app's dashboards and saved searches do not appear when they log in, even though the app appears in the Apps menu. The administrator confirms the app is enabled globally. Which setting in app.conf should be checked to ensure the app's navigation and views are visible to all users?
A Splunk administrator is configuring a search head cluster to improve search performance and availability. Which two components are required for a search head cluster to function? (Choose two.)
A Splunk administrator needs to confirm which license group is currently active on a standalone indexer before onboarding additional data sources. Which CLI command should the administrator run on the indexer to display the active license group?
A Splunk administrator needs to ensure that a Universal Forwarder continues to send data to an indexer even if the indexer becomes temporarily unavailable. The administrator wants the forwarder to buffer data and retry sending when the indexer is back online. Which setting in outputs.conf should be configured to enable this behavior?
A Splunk administrator needs to ensure that all search activity performed by users in the 'security' role is audited, including the search strings they run. The administrator wants to capture this information without deploying any additional apps. Which built-in Splunk capability should be enabled and configured to accomplish this?
A Splunk administrator is configuring a new indexer to join an existing indexer cluster. The administrator needs to ensure that the indexer can communicate with the cluster master and receive configuration updates. Which TWO settings must be configured in server.conf on the new indexer? (Choose two.)
A Splunk administrator needs to configure a forwarder to send data to multiple indexers for load balancing and high availability. The administrator wants to ensure that if one indexer becomes unavailable, the forwarder automatically sends data to another available indexer. Which outputs.conf configuration should be used?
A Splunk administrator is configuring a deployment server to manage a large number of universal forwarders. The administrator wants to ensure that the forwarders are properly assigned to server classes and receive the correct configurations. Which TWO of the following are true regarding the deployment server and its configuration? (Choose two.)
A Splunk administrator is reviewing the default filesystem layout of a Splunk Enterprise installation on a Linux host to plan backups and configuration management. Which two directories are part of the default installation structure? (Choose two.)
When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?
You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?
You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?
You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?
A Splunk administrator needs to add a new user account for a security analyst. The analyst should be able to run searches and create reports but must not have the ability to modify system configurations or manage other users. Which default role should be assigned to this user?
A Splunk administrator has deployed a new search head and wants to confirm that the license slave can reach the license manager on TCP port 8089. Which file should the administrator inspect to verify the license manager URI configured on the search head?
An administrator is preparing to deploy a new Splunk Enterprise indexer in a distributed environment. To ensure the indexer can receive data from forwarders on the default Splunk receiving port, which port must be open on the indexer's firewall?
A Splunk administrator needs to onboard a new log source on a heavy forwarder and wants the parsed events sent to an indexer while ensuring the forwarder itself parses the data before transmission. Which configuration file on the heavy forwarder controls where the parsed events are sent?
A Splunk administrator is configuring a search head cluster and needs to ensure that scheduled searches and alerts are distributed across all members. The administrator also wants to avoid a single point of failure for the scheduler. Which configuration should be implemented?
A Splunk administrator is preparing to install a new app across a search head cluster and wants to avoid configuration conflicts with existing apps. Before installation, the administrator reviews the app's default configuration files. Where should the administrator expect to find the app's default settings after installation?
A Splunk administrator needs to verify which TCP port the Splunk Web interface listens on by default in a standard single-instance deployment. Which port is used?
An administrator needs to add a new index named 'web_logs' on an indexer and ensure that the data is stored in a specific directory. Which file should be edited to define the index and its home path?
A Splunk administrator is diagnosing why a universal forwarder is not sending data to the indexers even though the inputs are configured and the service is running. The administrator suspects the forwarder is not loading the expected outputs configuration. Which command should the administrator run to list the active configuration settings the forwarder is currently using?
An administrator is troubleshooting a parsing issue where multiline events, such as Java stack traces, are being split into separate events. The administrator wants to adjust the line-breaking behavior. Which configuration file and stanza should be modified?
An administrator needs to configure a Splunk Universal Forwarder to send data to an indexer using a specific port and also to use a specific app for parsing. Which configuration file should be edited to set the target indexer and port?
A Splunk administrator is troubleshooting a licensing violation where the daily indexing volume exceeds the licensed amount. The administrator notices that a large amount of data is being indexed from a syslog source that includes many repetitive debug messages. Which action would best reduce the indexed volume without losing critical information?
A Splunk administrator is planning the deployment of a new distributed environment and is documenting which responsibilities belong to the search head tier. Which two functions are performed by search heads? (Choose two.)
An administrator wants a set of index-time field extractions and custom source types to be available only to a specific department's users while remaining hidden from all other users on the same search head. Which configuration approach accomplishes this?
A Splunk administrator is troubleshooting a search that is returning incomplete results. The administrator suspects that the search is not waiting long enough for all indexers to respond. Which setting in the search head's configuration can be adjusted to increase the time the search head waits for indexers to return results?
A Splunk administrator is reviewing the roles and capabilities assigned to users in a distributed deployment. Which two statements accurately describe how roles and capabilities work in Splunk Enterprise? (Choose two.)
A Splunk administrator is troubleshooting a search head cluster where users report that scheduled searches are not running consistently across all members. The administrator suspects that the captain is not properly managing the search artifacts. Which command should be used to verify the captain's status and the replication of search artifacts?
A Splunk administrator is preparing a distributed deployment and must decide which functions belong to the indexer tier rather than the search head tier. Which two of the following are responsibilities of Splunk indexers? (Choose two.)
After installing a new app on a search head, users report that the app's dashboards do not appear in their navigation. The administrator wants to check the app's configuration to see how its navigation is defined. Where are the local configuration files for an installed app located?
An administrator notices that a scheduled saved search owned by a service account stopped firing after the account's password was changed in the authentication system. The saved search has no alert action and is not part of a report acceleration. What is the most likely cause and the correct way to restore execution?
A Splunk administrator is setting up a new indexer and needs to specify the maximum size that the index can grow to before Splunk begins deleting the oldest data. Which setting in indexes.conf should be used?
A Splunk administrator is planning a deployment where indexers must continue accepting data even if the license master becomes temporarily unreachable. The administrator wants to understand how license enforcement behaves in a distributed environment. Which statement best describes the behavior?
A Splunk administrator needs to allow a new role to search only the web and security indexes while preventing access to all other indexes. Which setting in authorize.conf accomplishes this for the role?
A Splunk administrator is configuring a new search head cluster and needs to ensure that knowledge objects (such as saved searches and dashboards) are replicated across all members. Which configuration file and setting must be used to define the replication factor for the search head cluster?
A Splunk administrator is setting up a new search head and needs to ensure that users can authenticate using their existing LDAP credentials. The administrator wants to map LDAP groups to Splunk roles. Which configuration file must be edited to define the LDAP strategy and group mappings?
A Splunk administrator has just completed a fresh installation of Splunk Enterprise on a Linux server and needs to set the admin account password before the instance is connected to the network. Which CLI command should the administrator run?
A Splunk administrator is preparing a single indexer to receive forwarded data from many universal forwarders. The administrator wants the forwarders to send data to the indexer's receiving port. Which action enables the indexer to accept this forwarded data?
A Splunk administrator is reviewing role-based access control for a team that should be able to create and share searches and dashboards but must not be able to manage users, indexes, or other administrative settings. Which built-in role best fits this requirement with least privilege?
A Splunk administrator needs to install a new app on a single search head in a non-clustered environment. The administrator wants to use the CLI because the server has no browser access. Which command should be used to install the app from a local package file?