202 questions total · 3pages · All types, answers revealed
How can an administrator monitor failed login attempts for a specific user?
Failed logins are logged in the access logs.
Why this answer
Failed login attempts are recorded in the 'audit' index under the 'splunkd_access.log' source.
You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?
This is the standard pattern for routing data to different destinations.
Why this answer
Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.
Which TWO items are managed within the 'Access Controls' menu in Splunk Web?
User accounts are managed here.
Why this answer
Access controls is the primary location for managing users and roles.
What is the primary function of the Deployment Server?
It pushes apps and configs to forwarder clients.
Why this answer
The Deployment Server acts as a central repository for managing configurations and apps across forwarders.
An administrator needs to monitor a script output every 60 seconds. Which configuration in inputs.conf is correct for a scripted input?
This is the correct syntax for defining a scripted input with a 60-second interval.
Why this answer
The interval attribute in seconds determines how often a script is executed.
Which THREE parameters must be exchanged between Splunk and an Identity Provider for SAML to work?
Contains configuration data for the handshake.
Why this answer
SAML integration requires the exchange of metadata, typically including entity IDs and certificates.
Which TWO locations are common places to check for configuration files on a Linux Splunk instance?
System-wide settings reside here.
Why this answer
Configurations reside in system/local or app/local directories.
Which TWO of the following are true about Heavy Forwarders?
Advanced routing is a key capability.
Why this answer
Heavy Forwarders can perform indexing (if enabled) and parsing, which UFs cannot.
Which THREE of these represent common issues when troubleshooting LDAP authentication?
Prevents Splunk from finding the user object.
Why this answer
Incorrect bind credentials, incorrect search filters, and mapping issues are the most frequent causes of LDAP failure.
To monitor a network port using a Universal Forwarder, which stanza should be added to inputs.conf?
This stanza defines a network listener for data input.
You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?
Splunk sorts files alphabetically and applies them in order when precedence is tied.
Why this answer
When precedence is tied, Splunk uses a deterministic method based on the filename, sorting alphabetically.
Which Splunk process is responsible for the actual indexing of data on the indexer?
Splunkd is the core process that handles indexing and management.
Why this answer
Splunkd is the main daemon responsible for all core Splunk functionality, including indexing.
Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?
inputs.conf defines the listener.
Why this answer
inputs.conf is the standard file for configuring data inputs like TCP ports.
You need to ensure that specific data is retained for 365 days. Which parameter in indexes.conf controls this?
This setting dictates the retention period in seconds.
Why this answer
'frozenTimePeriodInSecs' defines the duration in seconds that data stays in an index before being moved to frozen/deleted.
Which TWO of the following are true about 'local' versus 'default' directories?
Local is the safe place for custom configurations.
Why this answer
Local overrides default, and local is where changes should be made to survive upgrades.
Which TWO of the following directories are used to store Splunk configuration files?
Contains original settings.
Why this answer
Default and Local directories are the standard locations for configuration files.
Which TWO settings are required to enable cold-to-frozen archiving?
Defines where the script archives data.
Why this answer
To enable archiving, you must define the coldToFrozenScript and ensure the path for frozen data exists.
Which TWO of the following are valid ways to authenticate users in Splunk?
This is the default authentication mechanism.
Why this answer
Splunk supports internal database authentication and various external providers like LDAP and SAML.
You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?
This is the designated menu for managing Splunk users.
Why this answer
Settings -> Users provides the UI to create and modify user attributes and roles.
If you need to change the logging level of a specific component on a Universal Forwarder, which file should you edit?
This file is specifically for configuring internal Splunk log levels.
Why this answer
log-local.cfg (or log.cfg) controls the granularity of internal Splunk logging.
Which user account is created by default and intended for administrative use, which should have its default password changed immediately?
'admin' is the default superuser account.
Why this answer
The 'admin' user is the default superuser account.
Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?
The Deployment Server is designed for forwarder configuration management.
Why this answer
The Deployment Server is the primary mechanism for centralizing and pushing configuration updates to forwarders.
If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?
Because 'RoleA' has the capability, the user inherits it.
Why this answer
Capabilities in Splunk are additive; if any assigned role has the capability, the user possesses that capability.
Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?
This is part of the application hierarchy.
Why this answer
System and App directories are core parts of the configuration hierarchy.
What is the purpose of the 'srchFilter' attribute in a role definition?
'srchFilter' enforces a search-time filter for specific roles.
Why this answer
The 'srchFilter' adds a hidden search filter to all searches run by the user to ensure data isolation.
Which TWO of the following are true about the 72-hour grace period?
If connectivity isn't restored, indexing will eventually stop.
Why this answer
The 72-hour grace period applies when a slave cannot reach the master; it is not a violation in the 30-day window sense.
You have a deployment server managing 500 Universal Forwarders. You need to update a specific app for only 50 of them based on OS type. How should you organize the deployment?
Server classes are designed to group forwarders for specific app deployment.
Why this answer
Serverclass.conf allows targeting clients using filters based on machine name or other attributes.
What happens to Splunk search capabilities when the license limit is reached for the first time in a 30-day period?
The first violation provides a warning but no immediate shutdown.
Why this answer
A violation occurs, but search is not blocked on the first occurrence within a rolling 30-day window.
Which THREE of the following represent true statements about the 'transforms.conf' file?
SEDCMD is used in props.conf, but transforms can also be used for filtering/routing which effectively anonymizes data.
Why this answer
transforms.conf is used for complex extractions, routing, and anonymization.
What happens to a local user account if the underlying LDAP group they belong to is deleted?
Without the LDAP group, the authentication provider cannot verify the user's credentials.
Why this answer
The local Splunk user object remains, but if authentication is tied exclusively to the LDAP group, the user will be unable to log in.
Which of the following is a primary reason to choose a Heavy Forwarder over a Universal Forwarder?
Heavy Forwarders can perform parsing and transformations which Universal Forwarders cannot.
Why this answer
Heavy Forwarders are required when you need to parse data, mask sensitive information, or route data based on content before it reaches the indexer.
Which THREE of the following actions can be performed from the 'Settings' menu in Splunk Web?
Roles are managed under Settings -> Access Controls.
Why this answer
Settings includes access to indexes, knowledge objects, and licensing.
Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?
Valid for app-specific settings.
Why this answer
Custom configs should be placed in local directories to follow best practices.
Which THREE items are included in a bucket's directory?
The index for searching.
Why this answer
A standard bucket directory contains raw data, metadata files, and search-time indexes (tsidx).
A company is migrating from an Enterprise license to a Free license. What is the most significant functional impact on their Splunk deployment?
The Free license removes access control and authentication features.
Why this answer
The Free license disables authentication, meaning all users are logged in as admin by default.
When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?
This prevents reading historical logs upon initial startup.
Why this answer
followTail ensures that only new data appended to the file is ingested, ignoring existing content.
An administrator wants to see a daily breakdown of license usage for the last 30 days. Which view is most appropriate?
This provides the historical visualization needed.
Why this answer
The 'Usage Report' within the Licensing section of Splunk Web provides this historical visualization.
You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?
App-level configurations take precedence over system-level configurations.
Why this answer
App-level local directory configurations override system-level local configurations.
Which TWO settings are commonly required when configuring an LDAP strategy?
Required to map directory groups to roles.
Why this answer
LDAP strategies require a base DN for users and a user-to-DN mapping format.
Which TWO settings in indexes.conf are used to control the rotation of hot buckets?
Limits time span of the bucket.
Why this answer
maxDataSize and maxHotSpanSecs are the two primary parameters that determine when a bucket should roll from hot to warm.
Which TWO of the following are true regarding the configuration of multiple license pools?
A slave belongs to one pool at a time.
Why this answer
Pools allow for dividing the total capacity, but the sum of pool quotas cannot exceed the total license volume.
Which THREE of the following are components of a standard Splunk architecture?
Forwarder collects data.
Why this answer
Indexers, Search Heads, and Forwarders are the core components of Splunk architecture.
You need to ensure that an index does not exceed 500GB of total disk space. Which configuration setting in indexes.conf should you modify?
This setting defines the maximum size of the index in megabytes.
Why this answer
maxTotalDataSizeMB is the correct setting to limit the total size of an index on disk.
You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?
props.conf is where you define timestamp extraction rules.
Why this answer
The TIME_PREFIX and TIME_FORMAT settings in props.conf determine how Splunk parses timestamps from raw logs.
You need to ensure that Data Models are accelerated. Where are the acceleration summaries stored?
Summaries reside in the _summary directory within the index.
Why this answer
Data model acceleration summaries are stored in the indexer where the data resides, specifically within the index's bucket structure.
What is the maximum number of license violations allowed in a 30-day period before search is blocked?
5 violations are allowed in 30 days.
Why this answer
Splunk allows 5 violations in a 30-day rolling window before blocking search.
What is the consequence of having the same 'serverName' in server.conf for two different Universal Forwarders?
This creates confusion and incorrect reporting in the Monitoring Console.
Why this answer
Splunk uses the serverName to uniquely identify internal logs; duplicate names cause conflicts in the monitoring console.
If a user is assigned to a role that does not have the 'license_tab' capability, what will they see in the Settings menu?
Capabilities restrict UI visibility.
Why this answer
The 'license_tab' capability controls visibility of the Licensing menu item in Settings.
Which TWO methods can be used to monitor the disk usage of an index?
Provides an overview.
Why this answer
The Splunk GUI provides a dashboard and the CLI provides 'splunk list indexes' to view status.
You are deploying a Universal Forwarder to a Windows server that must monitor local Event Logs and send them to an Indexer. Which component is required to handle the parsing of these logs before they are forwarded?
Universal Forwarders send raw data; parsing occurs on the Indexer tier.
Why this answer
Universal Forwarders do not perform heavy parsing. They forward data as-is, and the Indexer handles the parsing.
When using the 'splunk cmd splunkd bucket-info' tool, what are you primarily investigating?
Bucket-info provides detailed metadata about the specific bucket.
Why this answer
This tool allows administrators to inspect the properties of individual buckets, such as size, state, and event counts.
After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?
Permissions control whether an app is visible to specific user roles.
Why this answer
If the app is installed but not visible, the user's permissions for the app or the dashboard objects are likely missing.
You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?
The UI provides fields for mapping IdP attributes to Splunk user attributes.
Why this answer
The SAML attribute mapping is defined in the SAML configuration within the Splunk Web UI under Access Controls > Authentication Method.
What is the default role assigned to a new user account if no other role is specified?
'user' is the standard default role.
Why this answer
The 'user' role is the default role assigned to new accounts.
You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?
The deployer is the official tool for distributing configurations in a Search Head Cluster.
Why this answer
Splunk configurations should be managed via the Deployment Server or a Configuration Management tool like Git/Ansible to ensure consistency across search heads.
Which THREE actions occur when a Universal Forwarder is added to a Deployment Server?
The DS identifies what the client should receive.
Why this answer
The forwarder handshakes, downloads app bundles, and restarts/reloads as configured.
Which TWO of the following settings are typically found in inputs.conf?
Defines a TCP network input.
Why this answer
inputs.conf is used to monitor files and listen on network ports.
Which file is responsible for defining how data is rotated in an index?
indexes.conf manages index retention and rotation.
Why this answer
indexes.conf contains settings like maxDataSize and maxHotSpanSecs which define data rotation.
What happens to a user's session if their role is modified while they are logged in?
Session-based caching requires a re-login to pick up new permissions.
Why this answer
Changes to a user's role permissions take effect only upon the next login (or session refresh).
Which TWO of the following are valid ways to resolve a license violation?
Increasing quota resolves the overage.
Why this answer
A violation can be resolved by increasing the quota via a new key or reducing the data ingestion volume.
A user reports that their search is failing to return data from 3 years ago, even though the retention policy is set to 5 years. What is the most likely cause?
If the disk space limit is reached, Splunk rolls buckets to frozen regardless of the time policy.
Why this answer
The frozenTimePeriodInSecs is the primary retention limit; if it is set correctly, check the maxTotalDataSizeMB, which might trigger rolling to frozen earlier if the disk fills up.
Which THREE of the following are valid components of a Splunk license configuration?
The instance consuming the license.
Why this answer
License masters, slaves, and pools are all integral parts of a managed license deployment.
You need to restrict a specific user role from searching a particular index. Where is this configuration defined?
authorize.conf contains the roles and their associated search permissions.
Why this answer
Role-based access control (RBAC) allows you to restrict indexed data access via the 'srchIndexesAllowed' setting in authorize.conf.
Which Splunk GUI page provides a summary of all configured indexes and their current disk usage?
This page displays index configurations and usage metrics.
Why this answer
The 'Indexes' page under Settings > Data > Indexes provides a dashboard-style view of index status and usage.
Which THREE of the following are true regarding the behavior of 'btool'?
The 'check' command in btool validates syntax.
Why this answer
btool is a utility for viewing, checking, and debugging configuration files.
You need to restrict a specific user from accessing the 'internal' index even though their assigned role has access to all indexes. How do you implement this restriction?
Roles allow for granular control of index access via the 'srchIndexesAllowed' attribute.
Why this answer
You must create a new role that explicitly excludes the 'internal' index in the 'srchIndexesAllowed' field and assign it to the user.
Which TWO of the following are required to successfully add an indexer to a license pool?
Slaves must point to the master.
Why this answer
The indexer must point to the master, and the master must have the pool defined to accept that indexer.
What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?
Setting disabled=1 effectively turns off the data input.
Why this answer
The disabled attribute is used to stop an input from running without deleting the configuration.
Which stanza is required in props.conf to identify a sourcetype?
The name in brackets defines the sourcetype.
Why this answer
The sourcetype stanza is defined by the name enclosed in brackets, e.g., [my_sourcetype].
How does Splunk handle configuration files that are missing a required attribute?
Splunk provides default values for missing attributes.
Why this answer
Splunk generally uses default values if an attribute is omitted, provided the stanza itself is valid.
When a Splunk license violation occurs, how long does the warning period last before search is blocked?
The license warning period lasts for 14 days.
Why this answer
The warning period for a license violation is typically 14 days, allowing the admin to resolve the overage.
Which THREE of the following items are considered 'license slaves'?
A standalone instance acts as its own slave.
Why this answer
Only indexers and search heads (that perform indexing) are typically categorized as slaves in this context; heavy forwarders are not.
An administrator needs to increase the number of search results displayed in a dashboard panel. Where can this limit be adjusted?
limits.conf governs various search result constraints.
Why this answer
limits.conf contains global search limits including 'maxresults'.
What is the primary function of the 'thawed' bucket state?
Thawed buckets are where retrieved archived data is placed to become searchable.
Why this answer
The thawed state is used to store data that has been manually restored from a frozen (archived) state.
An administrator needs to move the License Master from one server to another. What is the most critical step?
All slaves must be updated to point to the new master.
Why this answer
Moving the license master requires transferring the license keys and re-pointing all slaves to the new master URI.
Practice SPLK-1003 by domain
Target a specific domain to shore up weak areas.