10 free Splunk SPLK-1003 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 209 questions. Work through them, then open each answer to check your reasoning.
Get all 209 questions (US$39) · Download these 10 as a PDF
Question 1
Which setting in indexes.conf allows data retention to be controlled by time?
Show answer and explanation
Correct answer: D. frozenTimePeriodInSecs
The frozenTimePeriodInSecs setting in indexes.conf controls data retention by specifying the time period (in seconds) after which buckets are moved to frozen. This is the primary time-based retention control in Splunk.
Why the other options are wrong
- A. maxDaysToKeep is not a valid indexes.conf setting for retention control.
- B. moveToFrozenAfter is not a valid indexes.conf setting; it does not exist in Splunk.
- C. maxDataRetentionTime is not the correct setting name used in indexes.conf.
Question 2
The universal forwarder has which capabilities when sending data? (Choose all that apply.)
Show answer and explanation
Correct answer: B, D
B. Compressing data D. Indexer acknowledgement The universal forwarder can compress data to reduce bandwidth usage and provide indexer acknowledgement to ensure reliable delivery. These are core data forwarding capabilities. Alerts are processed at the search head level, and data obfuscation is not a native forwarder function.
Why the other options are wrong
- A. Alerts are generated and managed at the search head, not by the universal forwarder.
- C. Data obfuscation or hiding is not a built-in capability of the universal forwarder.
Question 3
In case of a conflict between a whitelist and a blacklist input setting, which one is used?
Show answer and explanation
Correct answer: A. Blacklist
When there is a conflict between whitelist and blacklist settings, the blacklist takes precedence. This means items on the blacklist will be excluded even if they appear on a whitelist, implementing a deny-first security model.
Why the other options are wrong
- B. The whitelist does not override the blacklist; the opposite is true.
- C. They do not cancel each other out; one has priority over the other.
- D. The order of entry in the configuration file does not determine which takes precedence; blacklist always wins.
Question 4
In which Splunk configuration is the SEDCMD used?
Show answer and explanation
Correct answer: A. props.conf
SEDCMD (Sed Command) is used in props.conf to perform field-level transformations and data substitutions on events during parsing. This is where sed-like regular expression substitutions are configured.
Why the other options are wrong
- B. inputs.conf is for defining data inputs, not for field transformations.
- C. indexes.conf is for index-level settings and retention policies, not field transformations.
- D. transforms.conf is for defining field transformations but SEDCMD specifically belongs in props.conf.
Question 5
Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)
Show answer and explanation
Correct answer: A, B, D
A. CLI B. Edit inputs.conf D. Forwarder Management Inputs on a forwarder can be added with the CLI (for example 'splunk add monitor'), by directly editing inputs.conf, or by deploying an app containing inputs.conf through Forwarder Management on the deployment server. All three are supported methods.
Why the other options are wrong
- C. forwarder.conf is not a Splunk configuration file, so it cannot be used to add inputs.
Question 6
Which parent directory contains the configuration files in Splunk?
Show answer and explanation
Correct answer: A. $SPLUNK_HOME/etc
The $SPLUNK_HOME/etc directory is the parent directory that contains all configuration files in Splunk. Subdirectories within etc include apps, system, users, and deploymen-lient, which hold all configuration files.
Why the other options are wrong
- B. $SPLUNK_HOME/var contains variable data like logs and metadata, not configuration files.
- C. $SPLUNK_HOME/conf is not a standard Splunk directory structure.
- D. $SPLUNK_HOME/default is not a top-level directory; default configurations exist within subdirectories of etc.
Question 7
Which forwarder type can parse data prior to forwarding?
Show answer and explanation
Correct answer: D. Heavy forwarder
The heavy forwarder is the only forwarder type capable of parsing data prior to forwarding. It includes the full Splunk processing pipeline and can perform field transformations, filtering, and other advanced operations before sending data to indexers.
Why the other options are wrong
- A. The universal forwarder only collects and forwards raw data; it cannot parse.
- B. Heaviest forwarder is not a real Splunk forwarder type.
- C. Hyper forwarder is not a real Splunk forwarder type.
Question 8
Which Splunk component consolidates the individual results and prepares reports in a distributed environment?
Show answer and explanation
Correct answer: C. Search head
The search head consolidates individual results from multiple search peers and prepares reports in a distributed search environment. It coordinates the distributed search across indexers and manages the final aggregation and presentation of results.
Why the other options are wrong
- A. Indexers store and index data; they do not consolidate results or prepare reports.
- B. Forwarders send data to indexers; they do not consolidate results.
- D. Search peers are the indexers being searched, not the component that consolidates results.
Question 9
Which Splunk component distributes apps and certain other configuration updates to search head cluster members?
Show answer and explanation
Correct answer: A. Deployer
The Deployer is the specific Splunk component responsible for distributing apps and configuration updates to search head cluster members. It manages the distribution of the cluster bundle containing apps and configurations that need to be consistent across all search head cluster members.
Why the other options are wrong
- B. Cluster master manages indexer clustering, not search head cluster app distribution.
- C. Deployment server distributes configurations to deployment clients (forwarders, indexers), not search head cluster members.
- D. Search head cluster master is not a standard Splunk component; the correct term is Deployer.
Question 10
Where should apps be located on the deployment server that the clients pull from?
Show answer and explanation
Correct answer: D. $SPLUNK_HOME/etc/deployment-apps
Apps on the deployment server must be placed in $SPLUNK_HOME/etc/deployment-apps directory. This is the designated location where the deployment server expects to find apps that will be pushed to deployment clients. The deployment-apps directory distinguishes server-side app staging from regular local apps.
Why the other options are wrong
- A. $SPLUNK_HOME/etc/apps is the default location for apps on individual Splunk instances, not the deployment server staging area.
- B. $SPLUNK_HOME/etc/search is not a standard Splunk directory for app storage.
- C. $SPLUNK_HOME/etc/master-apps is used for cluster master app distributions, not deployment server apps.
That was 10 of 209.
The full Splunk SPLK-1003 pack has all 209 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.