SPLK-1003 Splunk Admin Basics Practice Test 4 — 15 Questions

Question 1

A Splunk administrator has deployed a new search head and wants to confirm that the license slave can reach the license manager on TCP port 8089. Which file should the administrator inspect to verify the license manager URI configured on the search head?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

server.conf. License manager addressing on a Splunk instance is configured in the [license] stanza of server.conf through the manager_uri setting. Verifying that value lets the administrator confirm the host and port the search head will contact, which is essential before diagnosing a license slave that cannot reach the license manager.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 2

An administrator is preparing to deploy a new Splunk Enterprise indexer in a distributed environment. To ensure the indexer can receive data from forwarders on the default Splunk receiving port, which port must be open on the indexer's firewall?

Accepted Answer

9997. The correct port for receiving data from forwarders is 9997, which is the default Splunk-to-Splunk receiving port. When an indexer is configured to receive data, it listens on this port for incoming connections from forwarders. The management port 8089 is for REST API and deployment, while 8000 is for Splunk Web. Port 8080 is not a standard Splunk port.

Answer

8080

Answer

8089

Answer

8000

Question 3

A Splunk administrator needs to onboard a new log source on a heavy forwarder and wants the parsed events sent to an indexer while ensuring the forwarder itself parses the data before transmission. Which configuration file on the heavy forwarder controls where the parsed events are sent?

Accepted Answer

outputs.conf. Because a heavy forwarder performs parsing locally, the parsed event stream is sent to downstream indexers according to the [tcpout] stanzas in outputs.conf. Editing that file to list the target indexer or indexer group ensures the data is delivered to the correct destination after local processing.

Answer

transforms.conf

Answer

inputs.conf

Answer

props.conf

Question 4

A Splunk administrator is configuring a search head cluster and needs to ensure that scheduled searches and alerts are distributed across all members. The administrator also wants to avoid a single point of failure for the scheduler. Which configuration should be implemented?

Accepted Answer

Use the search head cluster's built-in scheduling and artifact replication.. Search head clustering includes native support for distributing scheduled searches and replicating artifacts. Each member can run searches, and the cluster handles failover if a member goes down. This built-in mechanism ensures both load balancing and high availability, which is exactly what the administrator needs.

Answer

Configure a separate search head as the dedicated scheduler.

Answer

Set up a Deployment Server to run scheduled searches.

Answer

Enable the captain to run all scheduled searches.

Question 5

A Splunk administrator is preparing to install a new app across a search head cluster and wants to avoid configuration conflicts with existing apps. Before installation, the administrator reviews the app's default configuration files. Where should the administrator expect to find the app's default settings after installation?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/default/. Packaged app settings live in the app's default directory under $SPLUNK_HOME/etc/apps, where they serve as the baseline configuration. Local directories are reserved for overrides, so reviewing defaults is the correct way to see what the app will do before any administrator customization is applied.

Answer

$SPLUNK_HOME/etc/apps/<app_name>/local/

Answer

$SPLUNK_HOME/etc/users///local/

Answer

$SPLUNK_HOME/etc/system/local/

Question 6

A Splunk administrator needs to verify which TCP port the Splunk Web interface listens on by default in a standard single-instance deployment. Which port is used?

Accepted Answer

8000. Splunk Web listens on TCP port 8000 by default, serving the browser-based interface used for search, dashboards, and administration. The management port 8089 handles REST and CLI traffic, while 9997 receives forwarded data. Recognizing these default ports is fundamental for firewall rules, troubleshooting connectivity, and confirming that users can reach the correct service.

Answer

514

Answer

9997

Answer

8089

Question 7

An administrator needs to add a new index named 'web_logs' on an indexer and ensure that the data is stored in a specific directory. Which file should be edited to define the index and its home path?

Accepted Answer

indexes.conf. Index definitions, including the home path and other storage settings, are configured in indexes.conf. This file allows administrators to create new indexes and specify where their data resides on the file system. The other files manage different aspects of Splunk configuration and cannot accomplish this task.

Answer

outputs.conf

Answer

server.conf

Answer

inputs.conf

Question 8

A Splunk administrator is diagnosing why a universal forwarder is not sending data to the indexers even though the inputs are configured and the service is running. The administrator suspects the forwarder is not loading the expected outputs configuration. Which command should the administrator run to list the active configuration settings the forwarder is currently using?

Accepted Answer

splunk btool outputs list --debug. The btool utility merges default, local, and app-level configuration into the effective settings an instance uses, and the debug flag identifies the source file for each value. Running it against outputs shows exactly which forwarding destinations are active and where they were defined, which is the fastest way to diagnose a forwarder that is not sending data.

Answer

splunk diag

Answer

splunk list forward-server

Answer

splunk show config outputs

Question 9

An administrator is troubleshooting a parsing issue where multiline events, such as Java stack traces, are being split into separate events. The administrator wants to adjust the line-breaking behavior. Which configuration file and stanza should be modified?

Accepted Answer

props.conf, using the LINE_BREAKER setting within the appropriate source type stanza. Event boundary detection and multiline grouping are controlled by props.conf, specifically through LINE_BREAKER and related settings applied to a source type, host, or source. Adjusting the regular expression lets the administrator merge stack trace lines into single events. Other configuration files handle inputs, outputs, or field transforms and cannot change how event boundaries are determined.

Answer

transforms.conf, using the REGEX setting within a stanza referenced by a transform

Answer

outputs.conf, using the line_breaker setting within the tcpout stanza

Answer

inputs.conf, using the multiline_event_breaker setting within the monitor stanza

Question 10

An administrator needs to configure a Splunk Universal Forwarder to send data to an indexer using a specific port and also to use a specific app for parsing. Which configuration file should be edited to set the target indexer and port?

Accepted Answer

outputs.conf. The outputs.conf file on a Universal Forwarder defines the target indexers and the port used to send data. It includes stanzas for configuring groups of indexers and load balancing. Other files like inputs.conf, props.conf, and transforms.conf handle data input, parsing, and transformations, but not the forwarding destination.

Answer

inputs.conf

Answer

props.conf

Answer

transforms.conf

Question 11

A Splunk administrator is troubleshooting a licensing violation where the daily indexing volume exceeds the licensed amount. The administrator notices that a large amount of data is being indexed from a syslog source that includes many repetitive debug messages. Which action would best reduce the indexed volume without losing critical information?

Accepted Answer

Configure a null queue for the debug messages using transforms.conf and props.conf.. The most effective way to reduce indexed volume from specific repetitive messages is to filter them out before indexing using the null queue. This is done by creating a transform that matches the debug messages and a props.conf stanza that applies it to the relevant source type or host. This preserves other events and reduces license usage.

Answer

Set the license violation to auto-ignore for that source.

Answer

Enable index throttling on the indexer to limit data ingestion.

Answer

Increase the maxKBps setting on the universal forwarder.

Question 12

A Splunk administrator is planning the deployment of a new distributed environment and is documenting which responsibilities belong to the search head tier. Which two functions are performed by search heads? (Choose two.)

Accepted Answer

Providing the interface for knowledge object management such as saved searches and dashboards. Search heads orchestrate distributed searches by dispatching map phases to indexers and merging the reduce results, and they also host the user interface plus the knowledge object store. Raw data storage belongs to indexers, data collection to forwarders, and license administration to the license manager, so those functions are excluded from the search head role.

Answer

Collecting data from endpoints and forwarding it into the pipeline

Answer

Managing the license pool and issuing license warnings to peers

Answer

Storing raw event data in buckets on disk

Question 13

An administrator wants a set of index-time field extractions and custom source types to be available only to a specific department's users while remaining hidden from all other users on the same search head. Which configuration approach accomplishes this?

Accepted Answer

Place the props.conf and transforms.conf stanzas in the department's app and grant that app read access only to the department's role.. App-level permissions are the correct mechanism for scoping configurations to a subset of users. A dedicated app containing the props.conf and transforms.conf stanzas, with read access granted only to the department role, ensures the knowledge objects are applied for that role and hidden from everyone else. Global locations such as system/local or the search app apply to all users and cannot provide this isolation.

Answer

Define the extractions in the search-time props.conf of the search head and rely on field-level permissions.

Answer

Add the stanzas to the etc/apps/search app and use a search filter to remove the fields for unauthorized users.

Answer

Create the stanzas in etc/system/local on the search head so they override every other app.

Question 14

A Splunk administrator is troubleshooting a search that is returning incomplete results. The administrator suspects that the search is not waiting long enough for all indexers to respond. Which setting in the search head's configuration can be adjusted to increase the time the search head waits for indexers to return results?

Accepted Answer

remote_timelimit_seconds. The remote_timelimit_seconds setting in limits.conf controls the maximum time the search head waits for remote searches on indexers. Increasing this value gives indexers more time to respond, which can prevent incomplete results when indexers are slow. Other settings like max_results, dispatch.ttl, and max_combiner_mem do not affect the timeout period.

Answer

max_results

Answer

dispatch.ttl

Answer

max_combiner_mem

Question 15

A Splunk administrator is reviewing the roles and capabilities assigned to users in a distributed deployment. Which two statements accurately describe how roles and capabilities work in Splunk Enterprise? (Choose two.)

Accepted Answer

Capabilities are individual permissions, such as search or edit_user, that can be added to a role.. Roles are containers for capabilities and index permissions, and users can hold multiple roles whose permissions combine. Capabilities are the granular permissions added to roles. Index access is also defined within roles. This structure lets administrators compose access precisely, avoid granting excessive rights, and manage permissions centrally rather than per user.

Answer

Capabilities assigned to a role are inherited only if the user also has the admin role.

Answer

A user can be assigned only one role at a time in Splunk Enterprise.

Answer

Index permissions are granted directly to users and are not part of roles.