Splunk Admin Basics

After installing a new app on a search head, users report that the app's dashboards do not appear in their navigation. The administrator wants to check the app's configuration to see how its navigation is defined. Where are the local configuration files for an installed app located?

A Splunk administrator is diagnosing why a universal forwarder is not sending data to the indexers even though the inputs are configured and the service is running. The administrator suspects the forwarder is not loading the expected outputs configuration. Which command should the administrator run to list the active configuration settings the forwarder is currently using?

An administrator needs to configure a Splunk Universal Forwarder to send data to an indexer using a specific port and also to use a specific app for parsing. Which configuration file should be edited to set the target indexer and port?

A Splunk administrator is reviewing role-based access control for a team that should be able to create and share searches and dashboards but must not be able to manage users, indexes, or other administrative settings. Which built-in role best fits this requirement with least privilege?

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

A Splunk administrator is setting up a new search head and needs to ensure that users can authenticate using their existing LDAP credentials. The administrator wants to map LDAP groups to Splunk roles. Which configuration file must be edited to define the LDAP strategy and group mappings?

An administrator needs to add a new index named 'web_logs' on an indexer and ensure that the data is stored in a specific directory. Which file should be edited to define the index and its home path?

A Splunk administrator is preparing a distributed deployment and must decide which functions belong to the indexer tier rather than the search head tier. Which two of the following are responsibilities of Splunk indexers? (Choose two.)

What is the default port used by the Splunk Web interface?

An administrator needs to change the default maximum size of an index. Which file should be modified?

Which of the following is a valid method to restart the Splunk service on a Linux system?

A Splunk administrator is setting up a new indexer and needs to specify the maximum size that the index can grow to before Splunk begins deleting the oldest data. Which setting in indexes.conf should be used?

Where are the local configuration files for an installed app located?

Which Splunk component is primarily responsible for parsing and indexing incoming data streams?

A Splunk administrator is reviewing the roles and capabilities assigned to users in a distributed deployment. Which two statements accurately describe how roles and capabilities work in Splunk Enterprise? (Choose two.)

An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?

An administrator is troubleshooting a parsing issue where multiline events, such as Java stack traces, are being split into separate events. The administrator wants to adjust the line-breaking behavior. Which configuration file and stanza should be modified?

Which THREE of the following configurations can be performed in props.conf?

An administrator is preparing to deploy a new Splunk Enterprise indexer in a distributed environment. To ensure the indexer can receive data from forwarders on the default Splunk receiving port, which port must be open on the indexer's firewall?

An administrator notices that a scheduled saved search owned by a service account stopped firing after the account's password was changed in the authentication system. The saved search has no alert action and is not part of a report acceleration. What is the most likely cause and the correct way to restore execution?

Which Splunk process is responsible for the actual indexing of data on the indexer?

You need to ensure that specific data is retained for 365 days. Which parameter in indexes.conf controls this?

A Splunk administrator is configuring a search head cluster and needs to ensure that scheduled searches and alerts are distributed across all members. The administrator also wants to avoid a single point of failure for the scheduler. Which configuration should be implemented?

A Splunk administrator is planning a deployment where indexers must continue accepting data even if the license master becomes temporarily unreachable. The administrator wants to understand how license enforcement behaves in a distributed environment. Which statement best describes the behavior?

A Splunk administrator needs to verify which TCP port the Splunk Web interface listens on by default in a standard single-instance deployment. Which port is used?

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

A Splunk administrator needs to install a new app on a single search head in a non-clustered environment. The administrator wants to use the CLI because the server has no browser access. Which command should be used to install the app from a local package file?

Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?

Which THREE of the following actions can be performed from the 'Settings' menu in Splunk Web?

A Splunk administrator needs to add a new user account for a security analyst. The analyst should be able to run searches and create reports but must not have the ability to modify system configurations or manage other users. Which default role should be assigned to this user?

A Splunk administrator has deployed a new search head and wants to confirm that the license slave can reach the license manager on TCP port 8089. Which file should the administrator inspect to verify the license manager URI configured on the search head?

Which THREE of the following are components of a standard Splunk architecture?

You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?

A Splunk administrator is configuring a new search head cluster and needs to ensure that knowledge objects (such as saved searches and dashboards) are replicated across all members. Which configuration file and setting must be used to define the replication factor for the search head cluster?

After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?

Which TWO of the following settings are typically found in inputs.conf?

A Splunk administrator is preparing to install a new app across a search head cluster and wants to avoid configuration conflicts with existing apps. Before installation, the administrator reviews the app's default configuration files. Where should the administrator expect to find the app's default settings after installation?

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

A Splunk administrator is troubleshooting a search head cluster where users report that scheduled searches are not running consistently across all members. The administrator suspects that the captain is not properly managing the search artifacts. Which command should be used to verify the captain's status and the replication of search artifacts?

A Splunk administrator is planning the deployment of a new distributed environment and is documenting which responsibilities belong to the search head tier. Which two functions are performed by search heads? (Choose two.)

A Splunk administrator is troubleshooting a search that is returning incomplete results. The administrator suspects that the search is not waiting long enough for all indexers to respond. Which setting in the search head's configuration can be adjusted to increase the time the search head waits for indexers to return results?

A Splunk administrator is preparing a single indexer to receive forwarded data from many universal forwarders. The administrator wants the forwarders to send data to the indexer's receiving port. Which action enables the indexer to accept this forwarded data?

A Splunk administrator needs to allow a new role to search only the web and security indexes while preventing access to all other indexes. Which setting in authorize.conf accomplishes this for the role?

An administrator wants a set of index-time field extractions and custom source types to be available only to a specific department's users while remaining hidden from all other users on the same search head. Which configuration approach accomplishes this?

Which TWO of the following are true regarding the Deployment Server?

Which THREE of the following items are considered Knowledge Objects in Splunk?

What is the primary function of the 'Indexer Cluster' feature?

A Splunk administrator is troubleshooting a licensing violation where the daily indexing volume exceeds the licensed amount. The administrator notices that a large amount of data is being indexed from a syslog source that includes many repetitive debug messages. Which action would best reduce the indexed volume without losing critical information?

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

A Splunk administrator has just completed a fresh installation of Splunk Enterprise on a Linux server and needs to set the admin account password before the instance is connected to the network. Which CLI command should the administrator run?

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

A Splunk administrator needs to onboard a new log source on a heavy forwarder and wants the parsed events sent to an indexer while ensuring the forwarder itself parses the data before transmission. Which configuration file on the heavy forwarder controls where the parsed events are sent?

Which TWO of the following are true about the Universal Forwarder?

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?