SPLK-1003 Splunk Admin Basics Practice Test 2 — 15 Questions

Question 1

A Splunk administrator is configuring a deployment server to manage a large number of universal forwarders. The administrator wants to ensure that the forwarders are properly assigned to server classes and receive the correct configurations. Which TWO of the following are true regarding the deployment server and its configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A deployment client can belong to multiple server classes, and it will receive the union of all configurations from those classes.. The deployment server uses serverclass.conf to define server classes and map clients based on filters. Clients can belong to multiple server classes and receive merged configurations. The other options are false because phoneHomeIntervalInSecs is set on the client, deployment clients must be configured with the deployment server address but not necessarily in deploymentclient.conf, and the deployment server can deploy to universal forwarders.

Answer

The deployment server uses the 'phoneHomeIntervalInSecs' setting in serverclass.conf to control how often clients check for updates.

Answer

The deployment server can deploy configurations to indexers and search heads, but not to universal forwarders.

Answer

The deployment server requires that all deployment clients be configured with the deployment server's IP address and port in deploymentclient.conf.

Question 2

A Splunk administrator is reviewing the default filesystem layout of a Splunk Enterprise installation on a Linux host to plan backups and configuration management. Which two directories are part of the default installation structure? (Choose two.)

Accepted Answer

$SPLUNK_HOME/var/lib. The default Splunk Enterprise installation includes etc for configuration and var/lib for index data. These two directories are fundamental for administration: etc governs behavior and var/lib stores indexed events. The other paths either do not exist by default or misplace standard content, such as licensing under etc/licenses and scripted inputs within app bin directories.

Answer

$SPLUNK_HOME/share/splunk/plugins

Answer

$SPLUNK_HOME/bin/scripts

Answer

$SPLUNK_HOME/license

Question 3

Which Splunk component is primarily responsible for parsing and indexing incoming data streams?

Accepted Answer

Indexer. The indexer is the Splunk component that receives incoming data streams, parses them (applies line breaking, timestamp recognition, and sourcetype-based field extraction), and writes the resulting events into index buckets. Parsing and indexing are the indexer's core functions — forwarders only collect and forward, while search heads only query indexed data.

Answer

Deployment Server

Answer

Universal Forwarder

Answer

Search Head

Question 4

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. The most likely cause is that another process is already using port 9997. When Splunkd tries to bind to a port that is already in use, it fails to start or fails to listen on that port. This is a common issue when multiple instances or other applications are running on the same host.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 5

An administrator needs to change the default maximum size of an index. Which file should be modified?

Accepted Answer

indexes.conf. indexes.conf is the configuration file that defines index properties, including maxTotalDataSizeMB (the maximum size of an index) and frozenTimePeriodInSecs (retention). To change the default maximum size of an index, you modify the relevant index stanza in indexes.conf (typically in $SPLUNK_HOME/etc/system/local/ or an app). The setting maxTotalDataSizeMB controls the total disk footprint before the oldest buckets are frozen.

Answer

server.conf

Answer

props.conf

Answer

limits.conf

Question 6

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. For a Universal Forwarder, outputs.conf should be placed in $SPLUNK_HOME/etc/system/local/ because that directory holds machine-specific, administrator-created configurations that override defaults and are not tied to a particular app. This ensures the forwarder's output routing (including indexer discovery/load balancing) is applied globally.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/manager/local/

Answer

$SPLUNK_HOME/etc/apps/search/local/

Question 7

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Accepted Answer

props.conf. BREAK_ONLY_BEFORE is a line-breaking/event-merging setting that belongs in props.conf under the [] or [host::] stanza. It tells the parser to start a new event only when the specified regex matches, which is essential for correctly grouping multiline events like Java stack traces or log4j entries. Because props.conf governs parsing-time behavior on the indexer (or heavy forwarder), that is the correct file.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 8

An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?

Accepted Answer

Settings -> Apps -> Install app from file. In Splunk Web, apps and add-ons are installed via Settings > Apps > Install app from file, which opens a dialog to upload a .spl, .tar.gz, or .tgz package. This is the standard GUI method for installing a technology add-on on a standalone search head. The same path also allows browsing Splunkbase for apps.

Answer

Settings -> Forwarder Management

Answer

Settings -> Data Inputs -> Add new

Answer

Settings -> Server Settings -> System Settings

Question 9

Which of the following is a valid method to restart the Splunk service on a Linux system?

Accepted Answer

/opt/splunk/bin/splunk restart. The Splunk CLI provides the 'splunk restart' command, which cleanly stops and starts splunkd and all dependent processes. On a default Linux install, the binary lives at $SPLUNK_HOME/bin/splunk, so /opt/splunk/bin/splunk restart is the canonical method. This command handles process ordering and preserves configuration state, unlike manual kill or init-script approaches.

Answer

service splunk stop && service splunk start

Answer

/opt/splunk/bin/splunk reload

Answer

kill -9 $(pidof splunkd)

Question 10

What is the default port used by the Splunk Web interface?

Accepted Answer

8000. The Splunk Web interface (Splunk Web) listens on TCP port 8000 by default, which is where administrators and users access the browser-based UI for searching, dashboards, and administration. This is configured via the splunkweb stanza in web.conf (httpport setting). Port 8000 is distinct from the management port and the indexing/receiving port, making it the correct answer for browser-based access.

Answer

9997

Answer

8089

Answer

443

Question 11

After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?

Accepted Answer

The app permissions in 'Manage Apps'.. When an app's dashboards don't appear for a user, the most likely cause is that the app's objects (including dashboards) are not shared with the appropriate roles or users. Checking the app permissions in 'Manage Apps' (or the app's object permissions) is the first step to verify whether the dashboards are visible to that user's role.

Answer

The server license status.

Answer

The splunkd logs for critical errors.

Answer

The indexer cluster master status.

Question 12

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

Accepted Answer

authorize.conf. Role-based index access is controlled in authorize.conf, where each role stanza defines capabilities and, critically, the srchIndexesAllowed and srchIndexesDefault settings that determine which indexes a role can search. Restricting a user role from a specific index means editing the role's srchIndexesAllowed list in authorize.conf (or via the UI, which writes to authorize.conf). This is the authoritative file for role-to-index permissions.

Answer

user-prefs.conf

Answer

indexes.conf

Answer

authentication.conf

Question 13

Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?

Accepted Answer

Deployment Server. The Deployment Server is the Splunk component specifically designed to push configuration files (such as inputs.conf, outputs.conf, and apps) to large fleets of Universal Forwarders. Forwarders are configured with a deploymentclient.conf pointing to the Deployment Server, and they poll it for updated apps and configuration. This centralized management is essential at scale, avoiding manual configuration on each forwarder.

Answer

Heavy Forwarder

Answer

Indexer Cluster Master

Answer

Search Head Cluster Deployer

Question 14

You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?

Accepted Answer

props.conf. In Splunk, timestamp extraction and recognition rules are defined in props.conf using stanzas like TIME_PREFIX, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD, and TZ. This file is processed by the parsing pipeline on the indexer (or heavy forwarder) to assign the correct _time to events.

Answer

indexes.conf

Answer

inputs.conf

Answer

transforms.conf

Question 15

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

Accepted Answer

Settings -> Access Controls -> Users. In Splunk Web, user accounts are managed under Settings > Access Controls > Users. This interface allows an administrator to create a new user, set authentication credentials, and assign one or more roles, including the 'power' role. It is the most direct and standard way to create and assign roles to a user.

Answer

Settings -> Roles

Answer

Settings -> Server Settings

Answer

Settings -> Authentication Method