SPLK-1003 Splunk Admin Basics Practice Test 3 — 15 Questions

Question 1

Which Splunk process is responsible for the actual indexing of data on the indexer?

Accepted Answer

splunkd. The splunkd process is the core Splunk daemon that runs on all Splunk instances, including indexers, and is responsible for the actual indexing of data. It handles data ingestion, parsing, indexing, and search operations. When data is received by an indexer, splunkd processes it through the indexing pipeline and writes it to disk in buckets.

Answer

splunkweb

Answer

mongod

Answer

splunk-optimize

Question 2

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Accepted Answer

homePath. The homePath setting in indexes.conf specifies the directory where the index's data is stored. To move the index data directory to a new partition, you must update homePath to point to the new location. This setting is critical for relocating index data.

Answer

dataDir

Answer

maxTotalDataSizeMB

Answer

indexPool

Question 3

Where are the local configuration files for an installed app located?

Accepted Answer

$SPLUNK_HOME/etc/apps//local/. Local configuration files for an installed app reside in $SPLUNK_HOME/etc/apps//local/. This directory holds administrator-created or app-updated settings that override the app's default configurations. It is the app-scoped counterpart to system/local.

Answer

/var/log/splunk/

Answer

$SPLUNK_HOME/etc/system/local/

Answer

$SPLUNK_HOME/etc/apps/<app_name>/default/

Question 4

What is the primary function of the 'Indexer Cluster' feature?

Accepted Answer

To provide data replication and high availability.. Indexer clustering provides data replication and high availability by grouping indexers into a cluster with a replication factor and search factor. If a peer node fails, replicated buckets on other peers keep the data searchable, and the cluster master coordinates bucket fixup to restore the target replication/search factors. This is the primary purpose of the feature — resilience, not performance.

Answer

To increase the web interface speed.

Answer

To speed up search queries across multiple head nodes.

Answer

To manage user permissions for index access.

Question 5

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Option A is correct because the Universal Forwarder is a lightweight agent purpose-built to consume minimal CPU, memory, and disk resources on the source host, using a small binary with no bundled search or indexing components. Option D is correct because the Universal Forwarder does not parse or index data; it only collects, optionally compresses/encrypts, and forwards raw data (typically via TCP 9997) to a receiving indexer or heavy forwarder, where parsing and indexing occur. Option B is wrong because a Universal Forwarder can be configured with multiple outputs to send data to several indexers simultaneously, including via load balancing or an indexer cluster. Option C is wrong because the Universal Forwarder is free to download and use and does not require a Splunk Enterprise license; only the indexing/receiving side needs licensing. Option E is wrong because full parsing and indexing are performed by indexers (or heavy forwarders), not by the Universal Forwarder, which by design leaves data unparsed.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 6

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?

Accepted Answer

splunkd.log. splunkd.log on the indexer records connection attempts, handshakes, and errors from forwarders. It is the primary log for troubleshooting forwarder-to-indexer connectivity, including TCP connection issues, SSL negotiation, and authentication failures.

Answer

audit.log

Answer

web_service.log

Answer

metrics.log

Question 7

You need to ensure that specific data is retained for 365 days. Which parameter in indexes.conf controls this?

Accepted Answer

frozenTimePeriodInSecs. The frozenTimePeriodInSecs parameter in indexes.conf specifies the time in seconds after which buckets are considered frozen and eligible for deletion. To retain data for 365 days, you set frozenTimePeriodInSecs to 31536000 (the number of seconds in 365 days). This parameter controls the maximum age of data before it is removed from the index, unless a frozen archive is configured.

Answer

retentionPeriodDays

Answer

coldPathRetention

Answer

maxDataSize

Question 8

Which THREE of the following are components of a standard Splunk architecture?

Accepted Answer

Universal Forwarder. In a standard Splunk Enterprise distributed architecture, the three core components are the Universal Forwarder (C), which collects and forwards data from source systems to the indexing tier; the Indexer (D), which receives, parses, indexes, and stores the incoming data and handles search requests against it; and the Search Head (E), which provides the user interface and distributes search requests to the indexers, consolidating and presenting the results. These three roles map directly to Splunk's documented deployment model (forwarder → indexer → search head). A Database Server (A) is not a Splunk architectural component, since Splunk uses its own proprietary index store rather than an external database, and a Web Server (B) is not a separate Splunk component because the web UI is served by the Search Head itself.

Answer

Database Server

Answer

Web Server

Question 9

Which TWO of the following are true regarding the Deployment Server?

Accepted Answer

It manages configurations for deployment clients.. Option A is correct because the Deployment Server's core function is to push configuration content (apps, configuration files, and deployment apps) to its deployment clients, which poll it for updates. Option B is correct because the Deployment Server groups deployment clients into server classes, and each server class maps to specific apps/configurations that determine what each client receives. Option C is incorrect because deployment clients can be on any subnet or network reachable by the Deployment Server; there is no same-subnet restriction. Option D is incorrect because the Deployment Server is optional — it is not required in all Splunk deployments (e.g., single-instance or manually managed environments). Option E is incorrect because indexing raw logs is the role of indexers, not the Deployment Server.

Answer

It can only manage forwarders on the same subnet.

Answer

It is a required component for all Splunk deployments.

Answer

It is responsible for indexing raw logs.

Question 10

Which THREE of the following actions can be performed from the 'Settings' menu in Splunk Web?

Accepted Answer

Manage user roles.. Option B is correct because Splunk Web's Settings menu includes the Users and Authentication section, where administrators can create and manage user roles and their associated capabilities. Option D is correct because the Settings menu contains the Data Inputs page, which lets users configure inputs such as files, directories, TCP/UDP ports, and scripts to bring data into Splunk. Option E is correct because the Settings menu provides an Indexes page for creating, editing, and managing indexes, including their retention and size settings. Option A is not correct because writing raw C++ code for the Splunk engine is not a Splunk Web Settings function; the engine is not modified through the UI. Option C is not correct because restarting the physical operating system is an OS-level action, not a Splunk Web Settings menu action.

Answer

Write raw C++ code for the Splunk engine.

Answer

Restart the physical OS.

Question 11

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Option D is correct because the 'splunk status' CLI command queries the local splunkd process and reports whether Splunk is running, along with PID and component status, making it a standard supported method to monitor instance health. Option E is correct because the Monitoring Console app in Splunk Web provides a centralized, supported dashboard for monitoring the health, performance, and status of Splunk instances, including indexers, search heads, and forwarders. Option A is incorrect because /tmp lock files are not a documented or reliable status indicator and their presence does not reflect Splunk's operational state. Option B is incorrect because indexer cluster raw binary data (bucket files) is internal storage, not a monitoring interface, and reading it does not report instance status. Option C is incorrect because pinging a forwarder's local web port does not validate Splunk's status and forwarders typically do not run Splunk Web by default.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 12

Which THREE of the following configurations can be performed in props.conf?

Accepted Answer

Specifying timestamp extraction rules.. In Splunk, props.conf is the configuration file used to define settings that apply to events at index time and search time for a given sourcetype, host, or source. Option A is correct because timestamp extraction rules such as TIME_PREFIX, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD, and TZ are configured in props.conf to tell Splunk how to parse event timestamps. Option B is correct because props.conf is precisely where sourcetype properties are defined, including settings like SHOULD_LINEMERGE, LINE_BREAKER, TRUNCATE, and category/description metadata. Option C is correct because field extraction regexes are defined in props.conf via TRANSFORMS- stanzas that reference regex-based transforms in transforms.conf, or via inline EXTRACT- regex definitions. Option D is incorrect because index retention periods are set in indexes.conf using settings such as frozenTimePeriodInSecs or via the index's retention policy, not in props.conf. Option E is incorrect because TCP input ports are configured in inputs.conf under [tcp://] or [splunktcp://] stanzas, not in props.conf.

Answer

Setting index retention periods.

Answer

Configuring TCP input ports.

Question 13

Which TWO of the following settings are typically found in inputs.conf?

Accepted Answer

[tcp://...]. Option A, [tcp://...], is correct because inputs.conf defines data input stanzas, and a [tcp://] stanza configures the Splunk TCP data input that listens for raw or syslog data on a given port. Option E, [monitor://...], is also correct because a [monitor://] stanza in inputs.conf tells Splunk which files or directories to watch and index, making it one of the most common input types. The unmarked options do not belong: [indexer_cluster] and [search_head] are cluster role settings configured in server.conf, while [index_retention] is not a valid inputs.conf stanza and retention is controlled via indexes.conf settings such as frozenTimePeriodInSecs.

Answer

[indexer_cluster]

Answer

[index_retention]

Answer

[search_head]

Question 14

Which THREE of the following items are considered Knowledge Objects in Splunk?

Accepted Answer

Saved searches.. In Splunk, Knowledge Objects are user-created configurations that enrich, normalize, and present machine data, and Saved searches (C) qualify because they are reusable search definitions stored in Splunk that can be shared, scheduled, and used to drive other knowledge objects. Dashboards (D) are also Knowledge Objects since they are XML/JSON-defined panels and visualizations built from searches and stored in Splunk for reuse and sharing. Alerts (E) are Knowledge Objects as well, because they are saved search definitions with trigger conditions and actions that fire when results meet specified thresholds. Network cables (A) and hard drives (B) are physical hardware components, not Splunk-created knowledge artifacts, so they are not Knowledge Objects.

Answer

Network cables.

Answer

Hard drives.

Question 15

A Splunk administrator needs to add a new user account for a security analyst. The analyst should be able to run searches and create reports but must not have the ability to modify system configurations or manage other users. Which default role should be assigned to this user?

Accepted Answer

power. The power role is designed for users who need to run searches, create reports, and use advanced features but should not have administrative rights. The admin role grants full control, user is more limited, and can_delete is not a primary role. Therefore, power is the correct choice for a security analyst.

Answer

admin

Answer

can_delete

Answer

user