Troubleshooting practice questions

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Trap 1: --list-files

This is not a valid flag.

Trap 2: --debug

This flag displays the file and line number but is less specific than --show-files for paths.

Trap 3: --source

This is not a valid flag.

A
--show-files
This flag displays the source file for each configuration line.
B
--list-files
Why wrong: This is not a valid flag.
C
--debug
Why wrong: This flag displays the file and line number but is less specific than --show-files for paths.
D
--source
Why wrong: This is not a valid flag.

Question 2hardmultiple choice

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Trap 1: outputs.conf

outputs.conf defines where data is sent.

Trap 2: inputs.conf

inputs.conf defines how data is collected, not how it is parsed.

Trap 3: indexes.conf

indexes.conf defines index paths and storage settings.

A
outputs.conf
Why wrong: outputs.conf defines where data is sent.
B
inputs.conf
Why wrong: inputs.conf defines how data is collected, not how it is parsed.
C
indexes.conf
Why wrong: indexes.conf defines index paths and storage settings.
D
props.conf
props.conf is where parsing rules like multiline handling are defined.

Question 3hardmultiple choice

You are troubleshooting a file input that is not being ingested. You have verified the file path. Which command-line tool can show you if the file is being tracked by the monitor input?

Trap 1: splunk check files

This is not a valid command.

Trap 2: splunk debug input

While useful, it doesn't list monitored files specifically like 'list monitor'.

Trap 3: splunk show inputs

This is not a valid Splunk command.

A
splunk check files
Why wrong: This is not a valid command.
B
splunk debug input
Why wrong: While useful, it doesn't list monitored files specifically like 'list monitor'.
C
splunk list monitor
This displays the status of all files monitored by the instance.
D
splunk show inputs
Why wrong: This is not a valid Splunk command.

Question 4hardmultiple choice

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?

Trap 1: audit.log

audit.log tracks user actions and configuration changes.

Trap 2: web_service.log

web_service.log tracks web interface activity.

Trap 3: metrics.log

metrics.log tracks system performance and resource usage.

A
splunkd.log
splunkd.log records service activity and connection events.
B
audit.log
Why wrong: audit.log tracks user actions and configuration changes.
C
web_service.log
Why wrong: web_service.log tracks web interface activity.
D
metrics.log
Why wrong: metrics.log tracks system performance and resource usage.

Question 5easymultiple choice

What is the default retention policy for the '_internal' index?

Trap 1: Unlimited

Splunk never defaults to unlimited.

Trap 2: 90 days

This is not the default.

Trap 3: 1 day

Too short for troubleshooting.

A
Unlimited
Why wrong: Splunk never defaults to unlimited.
B
90 days
Why wrong: This is not the default.
C
1 day
Why wrong: Too short for troubleshooting.
D
30 days
The default for _internal is typically 30 days.

Question 6hardmulti select

Which THREE of these represent common issues when troubleshooting LDAP authentication?

Trap 1: The user's local disk is full.

Unrelated to authentication.

Trap 2: Browser cookie expiration

This is a client-side web issue.

A
Incorrect User Search Filter
Prevents Splunk from finding the user object.
B
Invalid Bind DN credentials
Prevents Splunk from querying the LDAP server.
C
Wrong LDAP server port
Prevents network connection to the server.
D
The user's local disk is full.
Why wrong: Unrelated to authentication.
E
Browser cookie expiration
Why wrong: This is a client-side web issue.

Question 7hardmultiple choice

You are troubleshooting an issue where a user cannot view a specific dashboard. The user has the 'user' role. What is the most likely cause?

Trap 1: The user does not have the 'admin' role.

Users do not need to be admins to see dashboards.

Trap 2: The index used in the search is not allowed.

While possible, the most direct cause for a missing dashboard is object-level permissions.

Trap 3: The user has too many roles assigned.

Having multiple roles increases permissions, it does not decrease them.

A
The user does not have the 'admin' role.
Why wrong: Users do not need to be admins to see dashboards.
B
The index used in the search is not allowed.
Why wrong: While possible, the most direct cause for a missing dashboard is object-level permissions.
C
The user has too many roles assigned.
Why wrong: Having multiple roles increases permissions, it does not decrease them.
D
The object permissions for the dashboard are not set to 'Global' or the user's role.
Dashboards require explicit read permissions for the user's role.