SPLK-1003 Practice Questions

Question 1

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

Accepted Answer

Both index1 and index2.. When a user inherits multiple roles, the permissions are additive — the user receives the union of all granted permissions. RoleA allows index1 and RoleB allows index2, so the user can search both index1 and index2. Splunk does not require a single role to grant all access; it merges srchIndexesAllowed across all effective roles.

Answer

Only index1.

Answer

Only index2.

Answer

No indexes.

Question 2

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Accepted Answer

transforms.conf. In Splunk, regex-based routing to different indexes is achieved by defining a transform with a REGEX and a DEST_KEY that points to the index metadata field (_MetaData:Index). This transform is defined in transforms.conf. The transform is then referenced from props.conf using a rule class (e.g., TRANSFORMS- = ). Therefore, transforms.conf is the file that must be configured to define the routing regex.

Answer

indexes.conf

Answer

props.conf

Answer

inputs.conf

Question 3

An administrator is configuring a new indexer to join an existing Splunk Enterprise deployment. The license master is at splunk-license.example.com:8089. The administrator runs the CLI command 'splunk edit licenser-localslave -master_uri https://splunk-license.example.com:8089'. What is the effect of this command?

Accepted Answer

It designates the indexer as a license slave and points it to the specified license master.. The command 'splunk edit licenser-localslave' with the -master_uri parameter configures the local instance as a license slave and points it to the license master. This is the correct way to add an indexer to a license master's management. It ensures the indexer reports its indexing volume and adheres to the license terms.

Answer

It configures the indexer to act as a license master for the deployment.

Answer

It enables the indexer to use the free license by contacting the license master.

Answer

It adds the specified license master to the indexer's search head pool.

Question 4

A Splunk administrator is planning the deployment of a new distributed environment and is documenting which responsibilities belong to the search head tier. Which two functions are performed by search heads? (Choose two.)

Accepted Answer

Providing the interface for knowledge object management such as saved searches and dashboards. Search heads orchestrate distributed searches by dispatching map phases to indexers and merging the reduce results, and they also host the user interface plus the knowledge object store. Raw data storage belongs to indexers, data collection to forwarders, and license administration to the license manager, so those functions are excluded from the search head role.

Answer

Collecting data from endpoints and forwarding it into the pipeline

Answer

Managing the license pool and issuing license warnings to peers

Answer

Storing raw event data in buckets on disk

Question 5

What is the primary function of the 'thawed' bucket state?

Accepted Answer

It is used to store restored frozen data.. The 'thawed' bucket state in Splunk is used to hold data that has been restored from a frozen archive. When an admin rebuilds a frozen bucket (e.g., from cold storage or backup), the restored bucket is placed in the thawed state so it can be re-indexed and made searchable again. It is not a normal lifecycle state for live data.

Answer

It is the default state for new data.

Answer

It is for data that is being deleted.

Answer

It is a cache for warm buckets.

Question 6

A company has a 1 TB per day Enterprise license shared across two pools: one for a security team indexing 600 GB per day and one for an IT operations team indexing 300 GB per day. The security team's pool is configured with a 500 GB per day quota. What happens when the security team's indexers exceed 500 GB in a single day while the IT operations pool remains under its quota?

Accepted Answer

The security pool records a violation against its pool, while the IT operations pool continues indexing under its own quota.. License pools partition the total license so each group's usage is measured against its own quota. When the security pool exceeds 500 GB in a day, the violation is attributed to that pool, while the IT operations pool stays within its allocation and continues indexing normally. This isolation is the primary reason to configure pools for separate teams.

Answer

The entire deployment immediately stops indexing until the next license window begins.

Answer

The security team's indexers are disabled and must be manually re-enabled by an administrator after the quota resets.

Answer

The overflow is automatically reallocated to the IT operations pool's unused quota to avoid a violation.

Question 7

An administrator receives reports that searches are returning warnings about license violations and that search has been partially restricted. The administrator wants to identify which indexers contributed the most indexing volume in the last 24 hours to determine the source of the overage. Which approach provides this information?

Accepted Answer

Run a search over the _internal index for license_usage.log events and use the splunk_server field to break down volume by indexer.. license_usage.log is written to the _internal index and records usage per reporting indexer, with splunk_server identifying the host. Searching that source and aggregating by splunk_server yields a ranked list of indexers by volume for the last 24 hours, which is the most direct way to find the hosts responsible for a license overage.

Answer

Query the license manager's REST endpoint /services/licenser/usage and aggregate results by pool name.

Answer

Inspect the indexer's metrics.log for per-sourcetype throughput and rank sourcetypes by volume.

Answer

Open the Monitoring Console License Usage view and read the Indexing Volume by Indexer panel for the last 24 hours.

Question 8

A Splunk administrator is configuring a Deployment Server to manage a large number of Universal Forwarders. The administrator notices that some forwarders are not receiving updated configurations. Upon investigation, the administrator finds that the forwarders have different 'serverName' values in server.conf than their actual hostnames. What is the most likely cause of the forwarders not receiving the updated configurations?

Accepted Answer

The Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass.. The most likely cause is that the Deployment Server uses the 'serverName' to identify forwarders, and if it does not match the hostname used in serverclass.conf filters, the forwarders will not match the serverclass and thus will not receive the updated configurations. The serverName is the client name that the forwarder reports to the Deployment Server. If it differs from the actual hostname, any serverclass filters based on hostname will fail to match.

Answer

The Deployment Server will ignore forwarders with duplicate serverName values, causing them not to receive configurations.

Answer

The forwarders will not be able to download apps because the serverName is used to determine the app directory path.

Answer

The forwarders cannot connect to the Deployment Server because the serverName is used for authentication.

Question 9

An administrator wants a set of index-time field extractions and custom source types to be available only to a specific department's users while remaining hidden from all other users on the same search head. Which configuration approach accomplishes this?

Accepted Answer

Place the props.conf and transforms.conf stanzas in the department's app and grant that app read access only to the department's role.. App-level permissions are the correct mechanism for scoping configurations to a subset of users. A dedicated app containing the props.conf and transforms.conf stanzas, with read access granted only to the department role, ensures the knowledge objects are applied for that role and hidden from everyone else. Global locations such as system/local or the search app apply to all users and cannot provide this isolation.

Answer

Define the extractions in the search-time props.conf of the search head and rely on field-level permissions.

Answer

Add the stanzas to the etc/apps/search app and use a search filter to remove the fields for unauthorized users.

Answer

Create the stanzas in etc/system/local on the search head so they override every other app.

Question 10

If a search head cluster member cannot access an indexer's bucket, what should you verify first?

Accepted Answer

The replication status and indexer clustering state.. When a search head cluster member cannot access an indexer's bucket, the most likely cause is a problem with the indexer clustering or replication state, such as a bucket not being properly replicated or a peer being down. Verifying replication status and indexer clustering state ensures that buckets are searchable and available. This is the first step because it directly addresses data availability across the cluster.

Answer

The indexer's license status.

Answer

The OS version of the search head.

Answer

The search head's RAM.

Question 11

You are configuring LDAP authentication for Splunk Enterprise. You want to ensure that users are authenticated against the LDAP directory and that their group memberships are mapped to Splunk roles. Which two configuration settings must you define in authentication.conf to achieve this? (Choose two.)

Accepted Answer

groupBaseDN. To authenticate users via LDAP and map their group memberships to Splunk roles, you must specify the userBaseDN to locate user accounts and the groupBaseDN to locate groups. These settings enable Splunk to search the directory for users and groups, and then use the roleMap to assign roles based on group membership.

Answer

bindDN

Answer

srvBaseDN

Answer

roleBaseDN

Question 12

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 13

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Accepted Answer

homePath. The homePath setting in indexes.conf specifies the directory where the index's data is stored. To move the index data directory to a new partition, you must update homePath to point to the new location. This setting is critical for relocating index data.

Answer

dataDir

Answer

maxTotalDataSizeMB

Answer

indexPool

Question 14

An administrator wants to view the current license usage and see which indexers are reporting to the license master. Which Splunk Web page should the administrator navigate to?

Accepted Answer

Settings > Licensing. In Splunk Web, license usage and the list of indexers reporting to the license master are found under Settings > Licensing. This page provides a comprehensive view of license consumption, including daily volume, quota, and violations. Other pages under Settings, such as Indexers, Server Settings, and Distributed Search, serve different purposes and do not display license information.

Answer

Settings > Server Settings

Answer

Settings > Distributed Search

Answer

Settings > Indexers

Question 15

A Splunk administrator is configuring SAML authentication for the company's Splunk Enterprise deployment. The Identity Provider (IdP) sends a group attribute named 'memberOf' containing the value 'CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. The administrator needs this group to automatically map to the 'power' role in Splunk. Which configuration file and stanza should the administrator edit to accomplish this?

Accepted Answer

authentication.conf, under the [roleMap_SAML] stanza with the attribute 'power = CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. SAML group-to-role mapping in Splunk Enterprise is configured in authentication.conf within a [roleMap_SAML] stanza, where each entry pairs a Splunk role with one or more IdP group values. This allows automatic role assignment at login based on the IdP's group assertion. The [saml] stanza handles identity provider connection details, while authorize.conf defines role capabilities, not SAML mappings.

Answer

authentication.conf, under the [saml] stanza with the attribute 'roleMap'

Answer

web.conf, under the [settings] stanza with the attribute 'samlRoleMapping'

Answer

authorize.conf, under the [role_power] stanza with the attribute 'samlGroup'

Splunk Enterprise Certified Admin SPLK-1003 practice test

Three ways to study

Study SPLK-1003 by domain

Study SPLK-1003 by topic

Configuration Files practice questions

Splunk Admin Basics practice questions

User And Authentication Management practice questions

Getting Data IN And Forwarder Management practice questions

Indexes And Data Management practice questions

License Management practice questions

SPLK-1003 fundamentals practice questions

SPLK-1003 scenario practice questions

SPLK-1003 troubleshooting practice questions

Splunk Enterprise Certified Admin (SPLK-1003) (SPLK-1003) practice questions