Splunk Settings Menu Features: Indexes, Data Inputs, Roles
Which THREE of the following are features available in the Splunk Settings menu?
Quick Answer
The answer is Roles, along with Indexes and Data Inputs, as the three features available under the Splunk Settings menu. The Settings menu serves as the central administrative hub for configuring core system components, where Indexes allows you to define storage locations and retention policies, Data Inputs provides access to configure all ingestion methods like monitor and HTTP Event Collector, and Roles is found under Access Controls to set role-based permissions and capabilities. On the Splunk Core Certified User SPLK-1002 exam, this question tests your ability to distinguish between configuration areas—common traps include confusing Knowledge Objects (like fields or tags) with system-level settings, which live under different menus. A reliable memory tip is to think of the Settings menu as the "plumbing and locks" of Splunk: it handles where data goes (Indexes), how it gets in (Data Inputs), and who can touch it (Roles).
⚠ Common exam trap
Splunk often tests the distinction between navigation elements (like Data summary and Search history, which are user-facing features within the Search app) and administrative configuration menus (Settings), causing candidates to confuse operational views with system settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Indexes
The Splunk Settings menu provides administrative controls for configuring core system components. Indexes (B) are correct because this menu allows you to create, edit, and manage index definitions, including setting retention policies and storage locations. Data inputs (C) is correct as the menu provides access to configure all input types (e.g., monitor, script, syslog, HTTP Event Collector). Roles (E) is correct because the Settings menu includes the Access Controls section where you can define role-based permissions and capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data summary
Why it's wrong here
Under app dropdown.
- ✓
Indexes
Why this is correct
Configured in Settings.
- ✓
Data inputs
Why this is correct
Configured in Settings.
- ✗
Search history
Why it's wrong here
Under user dropdown.
- ✓
Roles
Why this is correct
Configured in Settings.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1001
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are features available in the Splunk Web interface under the 'Settings' menu?
medium- A.Reports
- ✓ B.Knowledge
- ✓ C.Data Inputs
- D.Dashboards
- E.Search Center
Why B: The 'Settings' menu in Splunk Web provides administrative and configuration options. 'Knowledge' (B) is correct because it contains links to manage knowledge objects like event types, tags, and lookups. 'Data Inputs' (C) is correct because it is the central location for configuring how data enters Splunk, including monitoring files, network ports, and scripted inputs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.