SPLK-1003 Splunk Admin Basics — Timed 10 Questions

Question 1

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

10 minute time limit — choose an answer to begin.

Accepted Answer

splunk search "index=* sourcetype=your_type" | head 10. The 'splunk search' command allows you to run a search from the CLI. By searching for the specific sourcetype and limiting to 10 results, you can quickly verify if any data is being ingested for that sourcetype. This directly checks the indexed data, which is the most reliable way to confirm ingestion.

Answer

splunk list inputs

Answer

splunk status

Answer

splunk show conf

Question 2

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

Accepted Answer

Use a Search Head Cluster and push the bundle via the deployer.. In a Search Head Cluster (SHC), knowledge objects such as saved searches are managed centrally and distributed to all cluster members via the deployer using configuration bundles. The deployer pushes the bundle to the cluster captain, which then replicates it to all members, ensuring consistent knowledge objects across every Search Head. This is the officially recommended and supported method for synchronizing saved searches in a distributed environment.

Answer

Manually copy the local/savedsearches.conf file to every server.

Answer

Enable indexer discovery on all search heads.

Answer

Restart the Splunk services on all search heads.

Question 3

An administrator wants to prevent events from a specific IP address from being stored in an index. Which file and stanza would you use for this indexing-time filter?

Accepted Answer

transforms.conf: [setnull]. Index-time filtering that drops events entirely is implemented with a transforms.conf stanza using the setnull action, referenced from props.conf via the TRANSFORMS-<class> setting. The [setnull] stanza name is a conventional example; the key is that transforms.conf defines the REGEX and DEST_KEY = queue with FORMAT = nullQueue to route matching events to the null queue, discarding them before indexing. This is the standard Splunk method to prevent specific events (e.g., from a given IP) from being stored.

Answer

inputs.conf: [monitor://...]

Answer

outputs.conf: [tcpout]

Answer

props.conf: [default]

Question 4

An administrator needs to increase the number of search results displayed in a dashboard panel. Where can this limit be adjusted?

Accepted Answer

limits.conf. The number of search results displayed in a dashboard panel is controlled by the 'maxresults' or 'max_count' settings in limits.conf, specifically under the [searchresults] or [search] stanza. Administrators adjust limits.conf to change the default cap on results returned to a panel, which is a server-side limit that applies across dashboards and searches.

Answer

props.conf

Answer

authorize.conf

Answer

savedsearches.conf

Question 5

Which TWO of the following directories are used to store Splunk configuration files?

Accepted Answer

/default/. In Splunk's configuration directory structure, each app or add-on under $SPLUNK_HOME/etc/apps (or the system default at $SPLUNK_HOME/etc/system) contains a /default/ directory that holds the app's shipped, baseline configuration files such as .conf stanzas, which is why option B is correct. The same structure includes a /local/ directory that stores user- or admin-created configuration files and overrides, which take precedence over /default/ at runtime, making option E correct. These two directories are the standard precedence layers Splunk merges when loading configuration. By contrast, /var/ (A) is a general Linux filesystem location for variable data and not a Splunk config layer, /etc/ (C) is the OS-level configuration directory rather than Splunk's app config structure, and /bin/ (D) holds executable binaries, not configuration files.

Answer

/var/

Answer

/etc/

Answer

/bin/

Question 6

Which TWO of the following are true regarding Indexer Clustering?

Accepted Answer

It allows search heads to search across all indexers.. Option A is correct because Indexer Clustering is designed so that search heads can distribute searches across all peer indexers in the cluster, providing a unified search experience over the clustered data. Option D is correct because an indexer cluster requires a master node (also called the cluster manager) to coordinate replication, manage bucket fixup, and maintain the cluster's replication and search factors. The unmarked options are incorrect: forwarders are still needed to send data into the cluster (B), Splunk software installation is not automated by clustering (C), and the master node coordinates the cluster rather than performing indexing itself—indexing is done by the peer nodes (E).

Answer

It eliminates the need for any forwarders.

Answer

It automatically handles the installation of Splunk software.

Answer

The Master node performs the actual indexing.

Question 7

A Splunk administrator is configuring a new index that will receive data from a high-volume application. The administrator wants to ensure that the index is stored on a dedicated volume and that the data is replicated across the indexer cluster for fault tolerance. Which configuration settings must be specified in indexes.conf on the indexers?

Accepted Answer

homePath, coldPath, and the cluster's replication factor and search factor are configured at the cluster level, not in indexes.conf.. The index's storage location is defined by homePath and coldPath in indexes.conf. Replication and search factors are cluster-wide settings configured on the master node or in server.conf, not per index. Thus, the administrator must set the paths in indexes.conf and verify the cluster's replication and search factors are appropriate for fault tolerance.

Answer

repFactor and searchFactor

Answer

homePath, coldPath, and frozenTimePeriodInSecs

Answer

homePath and coldPath

Question 8

A Splunk administrator wants to onboard data from a custom application that writes a new log file each hour with a unique filename, such as app-2025-01-15-14.log. The files are rotated daily and old files are never deleted. The administrator needs to ensure that Splunk ingests both existing and future files without consuming excessive file handles. Which input stanza type should be used in inputs.conf?

Accepted Answer

[monitor:///var/log/app/app-*.log]. A monitor stanza with a wildcard path is the standard way to continuously ingest files that match a pattern, including newly created ones. It handles file rotation and does not need per-file configuration, making it the correct choice for hourly application logs that must be indexed as they appear.

Answer

[fschange:///var/log/app/]

Answer

[script:///var/log/app/app-*.log]

Answer

[batch:///var/log/app/]

Question 9

A Splunk administrator has installed a new app on a search head. Users report that the app's dashboards and saved searches do not appear when they log in, even though the app appears in the Apps menu. The administrator confirms the app is enabled globally. Which setting in app.conf should be checked to ensure the app's navigation and views are visible to all users?

Accepted Answer

state = enabled and visible = true in the [ui] stanza. The [ui] stanza in app.conf controls the app's visibility and state in the Splunk Web interface. Setting state = enabled activates the app, and visible = true ensures its dashboards, saved searches, and navigation are accessible to users. If visible is set to false, the app remains installed but its UI elements are hidden, which matches the reported symptoms.

Answer

version = 1.0 in the [launcher] stanza

Answer

is_configured = 1 in the [install] stanza

Answer

label = <App Name> in the [package] stanza

Question 10

A Splunk administrator is configuring a search head cluster to improve search performance and availability. Which two components are required for a search head cluster to function? (Choose two.)

Accepted Answer

Captain. A search head cluster requires a deployer to distribute configurations and a captain to coordinate cluster activities. The deployer ensures that all members have consistent apps and settings, while the captain manages search scheduling and artifact replication. Other components like cluster manager or license manager are not part of the search head cluster architecture.

Answer

License manager

Answer

Cluster manager

Answer

Indexer cluster manager