I85PREP
⌘ K
Splunk Enterprise Certified Admin study materials
Splunk Enterprise Certified Admin study resources

Splunk Enterprise Certified Admin practice questions

One question at a time. Build your Splunk Enterprise Certified Admin understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Splunk Deployment and Architecture

In a distributed Splunk Enterprise deployment, which component parses incoming data and writes it to disk as indexed buckets?

  1. The universal forwarder
  2. The deployment server
  3. The search head
  4. The indexer Correct answer.

Explanation

Indexers receive data from forwarders, parse it, and write it to disk as buckets in an index. Search heads coordinate searches but do not store the indexed data in a distributed deployment. Forwarders collect and send data, and the deployment server distributes configuration.

Question 2Splunk Deployment and Architecture

Which Splunk component can filter, route, and optionally index data before forwarding it to an indexer?

  1. Search head
  2. Heavy forwarder Correct answer.
  3. Universal forwarder
  4. Cluster master

Explanation

A heavy forwarder is a full Splunk Enterprise instance that can parse, filter, route, and optionally index data before forwarding. A universal forwarder only collects and forwards raw data with minimal processing.

Question 3Splunk Deployment and Architecture

By default, which port does splunkd use for management and REST API communication?

  1. 9997
  2. 8088
  3. 8089 Correct answer.
  4. 8000

Explanation

splunkd listens on port 8089 by default for management and REST API calls, including communication with deployment clients and cluster peers. Port 8000 is the web UI, 9997 is the default data-receiving port, and 8088 is the HTTP Event Collector.

Question 4Splunk Deployment and Architecture

Which Splunk Enterprise component sends configuration and app content to forwarders and is managed through forwarder management?

  1. Search head deployer
  2. Deployment server Correct answer.
  3. License manager
  4. Indexer cluster master

Explanation

The deployment server distributes apps and configuration to deployment clients such as forwarders, using server classes to decide what each client receives. It is administered through forwarder management.

Question 5Splunk Deployment and Architecture

What is the primary role of a search head in a distributed deployment?

  1. It tracks license usage.
  2. It runs searches across peers. Correct answer.
  3. It stores events in buckets.
  4. It collects data from endpoints.

Explanation

Search heads run searches, coordinate with search peers (indexers), and consolidate results. They do not store the indexed data in a distributed deployment.

Question 6Splunk Deployment and Architecture

What is a bucket in a Splunk index?

  1. A directory of indexed data and metadata. Correct answer.
  2. A schedule that triggers an alert action.
  3. A set of forwarders that share an outputs group.
  4. A user-defined search macro stored in an app.

Explanation

A bucket is a directory under an index that holds indexed data and its associated metadata, such as rawdata and index files. Buckets move through hot, warm, cold, and frozen states.

Question 7Splunk Deployment and Architecture

In an indexer cluster, what is the primary responsibility of the cluster master (manager) node?

  1. It holds a replicated copy of every bucket.
  2. It manages peer membership and replication. Correct answer.
  3. It pushes apps to universal forwarders.
  4. It executes all search jobs for the peer nodes.

Explanation

The cluster master coordinates replication, manages peer membership, and tells peers where bucket copies should reside. It does not run searches or store bucket copies itself.

Question 8Splunk Deployment and Architecture

An indexer cluster has a replication factor of 3 and a search factor of 2. How many searchable copies of each bucket does the cluster maintain?

  1. Three
  2. One
  3. Six
  4. Two Correct answer.

Explanation

Replication factor sets the total number of copies of each bucket, while search factor sets how many of those copies are searchable. With RF=3 and SF=2, the cluster keeps three copies and makes two of them searchable.

Question 9Splunk Deployment and Architecture

In a search head cluster, what is the role of the captain?

  1. It indexes data received from forwarders.
  2. It schedules jobs and replicates config. Correct answer.
  3. It acts as license manager for the cluster.
  4. It stores the cluster's frozen buckets.

Explanation

The captain is elected by the cluster members and coordinates search job scheduling and replication of configuration changes. It does not index data or store buckets.

Question 10Splunk Deployment and Architecture

How are apps and configuration typically distributed to the members of a search head cluster?

  1. By the deployer using splunk deploy. Correct answer.
  2. Through outputs.conf on each member.
  3. Through the cluster master's push mechanism.
  4. By each member pulling from the deployment server.

Explanation

Apps and configuration for a search head cluster are pushed from the deployer using the splunk deploy command. The deployer is not a member of the cluster and is not the cluster master.

Question 11Splunk Deployment and Architecture

What is the purpose of indexer discovery in Splunk Enterprise?

  1. It lets search heads locate indexes by their configured names.
  2. It discovers new data sources that run on the search head.
  3. It automatically creates new indexes on all of the peer nodes.
  4. It lets forwarders learn indexer addresses from the master. Correct answer.

Explanation

Indexer discovery lets forwarders query the cluster master for the list of peer indexers and their receiving ports, so they can send data without static outputs.conf entries. The master returns current peer information.

Question 12Splunk Deployment and Architecture

Which Splunk feature stores older bucket data on a remote object store while keeping metadata locally on the indexer?

  1. Search head clustering
  2. SmartStore Correct answer.
  3. Index replication
  4. Bucket thawing

Explanation

SmartStore keeps bucket metadata and a local cache on indexers while uploading older bucket data to a remote object store such as S3. This reduces local storage requirements.

Question 13Splunk Deployment and Architecture

Which configuration file on a forwarder specifies the indexers that should receive its data?

  1. props.conf
  2. inputs.conf
  3. outputs.conf Correct answer.
  4. indexes.conf

Explanation

outputs.conf defines where a forwarder sends data, including the indexer addresses and the receiving port. inputs.conf defines what data to collect, while props.conf and indexes.conf control parsing and index settings.

Question 14Splunk Deployment and Architecture

On a deployment server, what determines which deployment app a forwarder receives?

  1. The server class the forwarder matches Correct answer.
  2. The license group assigned to the forwarder
  3. The cluster label assigned to the search head
  4. The replication factor configured on the indexers

Explanation

A deployment server evaluates a client's attributes against server classes; the first matching server class determines which app content the client receives. License groups and indexer settings do not control app deployment.

Question 15Splunk Deployment and Architecture

Which node in a distributed Splunk Enterprise deployment tracks license usage across the environment?

  1. The cluster master
  2. The license manager Correct answer.
  3. The search head captain
  4. The deployment server

Explanation

The license manager receives license usage reports from all Splunk Enterprise instances and enforces the license terms. Forwarders do not report license usage.

Question 16Splunk Deployment and Architecture

What happens to a bucket when it rolls from warm to cold?

  1. It is deleted permanently.
  2. It moves to the cold path. Correct answer.
  3. It becomes searchable for the first time.
  4. It is replicated to another site.

Explanation

When a bucket rolls from warm to cold, Splunk moves it to the cold path defined for the index, and it remains searchable until it is rolled to frozen. Frozen buckets may be archived or deleted.

Question 17Splunk Deployment and Architecture

A multisite indexer cluster uses site_replication_factor = origin:2, total:3. What does this mean?

  1. Three sites with two peers each.
  2. Three copies at the origin site and two total.
  3. Two copies at the origin site and three total. Correct answer.
  4. Two searchable copies and three total copies.

Explanation

In a multisite cluster, site_replication_factor uses origin and total values. origin:2 means two copies at the site where the bucket originated, and total:3 means three copies across all sites.

Question 18Splunk Deployment and Architecture

Under what circumstance does a heavy forwarder consume license volume?

  1. When it forwards data to a remote indexer.
  2. When it indexes data locally. Correct answer.
  3. When it receives data on port 9997.
  4. When it uses indexer discovery.

Explanation

A heavy forwarder consumes license only when it indexes data locally, because indexed data counts against the license. Data that it merely forwards to another indexer is licensed at the receiving indexer.

Question 19Splunk Deployment and Architecture

After a peer node in an indexer cluster is replaced, which process brings its buckets into compliance with the replication and search factors?

  1. Bucket thawing
  2. Cluster fixup by the master Correct answer.
  3. Search head captain election
  4. The deployer's app push

Explanation

When a peer is replaced or a copy is lost, the cluster master directs fixup (backfill) so that buckets again meet the replication and search factors. Fixup copies buckets from peers that hold good copies.

Question 20Splunk Deployment and Architecture

What is the effect of setting the search factor equal to the replication factor in an indexer cluster?

  1. Search heads index their own data.
  2. No bucket replication occurs.
  3. The cluster master stores all buckets.
  4. All copies are searchable. Correct answer.

Explanation

The search factor determines how many copies are searchable. Setting it equal to the replication factor makes every copy searchable, which can increase indexing load and disk use but improves search availability.

Question 21License Management

In a distributed Splunk Enterprise deployment, which instance type consumes indexing license volume?

  1. Search heads
  2. Deployment servers
  3. Universal forwarders
  4. Indexers Correct answer.

Explanation

Only indexing volume is licensed, and indexers are the components that index data. Forwarders, deployment servers, and search heads do not add to the licensed daily indexing volume even though they may connect to the license manager.

Question 22License Management

What daily indexing volume does the Free license permit?

  1. 500 MB per day Correct answer.
  2. 5 GB per day
  3. 10 GB per day
  4. Unlimited indexing volume

Explanation

The Free license caps indexing at 500 MB per day and also disables several Enterprise features such as authentication and scheduled alerts. Any deployment needing more than that volume requires an Enterprise license.

Question 23License Management

How does Splunk Enterprise measure consumption of an Enterprise license?

  1. Number of events indexed per day
  2. Number of searches run per day
  3. Number of concurrent search users
  4. Daily indexed data volume, in gigabytes Correct answer.

Explanation

An Enterprise license specifies a volume of data in gigabytes per day, and Splunk compares actual indexed volume against that value using a rolling 30-day window. Event counts, user counts, and search activity are not part of the license metric.

Question 24License Management

An indexer has indexed more than its licensed daily volume every day for several months. What does Splunk Enterprise eventually do?

  1. It stops indexing new data until usage falls back within the license.
  2. It deletes the oldest indexed data to bring usage within the license.
  3. It switches the deployment to a Free license. Correct answer.
  4. It restricts search to administrator users only.

Explanation

Splunk Enterprise never blocks indexing because of a license overage; it logs warnings when usage exceeds the licensed volume. If the overage continues for 30 consecutive days the deployment is in license violation, and after 60 days of continuous violation the license manager switches the deployment to a Free license.

Question 25License Management

How many license managers can a single Splunk Enterprise instance report to at one time?

  1. Up to two, for redundancy
  2. As many as are defined in its license groups
  3. Up to four, one per indexer cluster
  4. Exactly one Correct answer.

Explanation

An instance acts as a license slave of exactly one license manager, configured in the [license] stanza of server.conf. There is no primary/secondary license manager pairing; redundancy is achieved by making the license manager highly available through other means.

Question 26License Management

Which server.conf setting makes an indexer report to a specific license manager?

  1. [clustering] mode
  2. [general] pass4SymmKey
  3. [license] master_uri Correct answer.
  4. [license] active_group

Explanation

The [license] stanza's master_uri setting (also accepted as manager_uri in newer releases) holds the URI of the license manager, typically https://<license_manager>:8089. The setting takes effect after splunkd is restarted.

Question 27License Management

Which REST endpoint on the license manager returns the list of instances that report license usage to it?

  1. /services/licenser/groups
  2. /services/licenser/licenses
  3. /services/licenser/pools
  4. /services/licenser/slaves Correct answer.

Explanation

The licenser/slaves endpoint on the license manager enumerates the connected license slaves, including the license group and pool each one is associated with. The other licenser endpoints describe configuration objects rather than reporting instances.

Question 28License Management

A Splunk Enterprise instance has just been installed and no license file has been added yet. Which license does it run under?

  1. The Enterprise Trial license, 500 MB per day for 60 days Correct answer.
  2. No license at all, so indexing is blocked until a license file is added
  3. The Forwarder license, which places no limit on indexed volume
  4. The Free license, which permits 500 MB of indexing per day indefinitely

Explanation

Every fresh Splunk Enterprise installation runs under the Enterprise Trial license, which permits 500 MB per day for 60 days. When the trial expires without a license file being added, the instance reverts to the Free license.

Question 29License Management

An Enterprise license group holds 300 GB/day, all of it in the default pool. You must cap two indexers at 100 GB/day combined while leaving other indexers on the remaining volume. What should you do?

  1. Set maxKBps on the two indexers to cap their throughput at 100 GB/day.
  2. Move the two indexers to the Free license group so they cannot exceed 100 GB/day.
  3. Create a 100 GB pool in the Enterprise license group and assign the two indexers to it. Correct answer.
  4. Create a new license group and add a 100 GB license file to it for the two indexers.

Explanation

Pools partition the volume of a license group, and pool sizes are drawn from the group's total license volume, shrinking the default pool accordingly. Assigning the two indexers to a 100 GB pool limits their combined licensed volume while the other indexers continue to draw on the default pool.

Question 30License Management

Which statement describes the license files that a single license group can contain?

  1. Any mixture of license stacks, because Splunk sums their volumes
  2. One license file per stack, up to a maximum of three stacks
  3. Only a single license file, which must be replaced to change the volume
  4. Multiple license files, provided they all belong to the same stack Correct answer.

Explanation

A license group is bound to one stack, such as enterprise, free, forwarder, or enterprise-trial. You can add several license files of that same stack and Splunk sums their volumes, but a file from a different stack goes into its own group.

Question 31Configuration Files

A setting appears in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/search/default/props.conf. Which value takes effect?

  1. The value from whichever file Splunk reads first
  2. The value in etc/system/local Correct answer.
  3. Both values, joined together with commas
  4. The value in etc/apps/search/default

Explanation

Splunk builds the effective configuration by layering files, and directories named default hold shipped fallback values. When the same attribute is defined in more than one layer, the higher-priority layer supplies the value outright; values are not blended across layers.

Question 32Configuration Files

Which configuration file holds the line-breaking, timestamp, and transform rules an indexer applies to incoming data?

  1. inputs.conf
  2. outputs.conf
  3. indexes.conf
  4. props.conf Correct answer.

Explanation

props.conf carries per-source, per-host, and per-sourcetype settings such as LINE_BREAKER, SHOULD_LINEMERGE, TIME_FORMAT, TRUNCATE, and transform references. inputs.conf describes where data comes from, indexes.conf describes index storage, and outputs.conf describes forwarding.

Question 33Configuration Files

In transforms.conf, which attribute names the lookup table file that a lookup definition reads?

  1. table
  2. filename Correct answer.
  3. source
  4. path

Explanation

A lookup definition is a stanza in transforms.conf whose filename attribute points to the table, typically a CSV located in the app's lookups directory. Splunk resolves that file at search time when the lookup is invoked.

Question 34Configuration Files

Which stanza heading correctly defines a file monitor input in inputs.conf?

  1. [monitor:///var/log/app.log] Correct answer.
  2. [path:///var/log/app.log]
  3. [watch:///var/log/app.log]
  4. [file:///var/log/app.log]

Explanation

input stanzas use a scheme followed by the target, and file monitoring uses the monitor scheme with an absolute path. Because the path itself begins with a slash, the stanza shows three slashes after the colon.

Question 35Configuration Files

Which indexes.conf attribute specifies the directory that stores an index's hot and warm buckets?

  1. coldPath
  2. thawedPath
  3. frozenPath
  4. homePath Correct answer.

Explanation

Every index stanza needs three paths: homePath for hot and warm buckets, coldPath for cold buckets, and thawedPath for buckets restored from archive. These paths must be writable and must not overlap one another.

Question 36Configuration Files

Which command shows the effective merged props.conf settings for a stanza and the file that supplied each value?

  1. splunk show config props --merged --source
  2. splunk diag props --list-sources
  3. splunk conf props validate --all
  4. splunk btool props list <stanza> --debug Correct answer.

Explanation

The btool utility merges system defaults, app files, and local files exactly as the running process does. Adding the debug flag annotates each resulting line with the path of the file it came from.

Question 37Configuration Files

A universal forwarder must send data to the indexer idx1 on port 9997. Where is that destination set in outputs.conf?

  1. In a [udpout] stanza with the attribute destination = idx1:9997
  2. In a [tcpout] stanza with the attribute indexer = idx1:9997
  3. In a [tcpout:<group>] stanza with the attribute server = idx1:9997 Correct answer.
  4. In a [tcpout-server://idx1:9997] stanza with the attribute port = 9997

Explanation

Forwarding destinations are declared in named output groups such as [tcpout:mygroup] using the server attribute, which accepts a comma-separated host:port list. The [tcpout] stanza then selects that group with defaultGroup.

Question 38Configuration Files

Which attribute of the [authentication] stanza in authentication.conf switches Splunk authentication to an LDAP directory?

  1. authScheme = ldap
  2. authMethod = LDAP
  3. authType = LDAP Correct answer.
  4. provider = ldap

Explanation

authType selects the authentication backend, and authSettings names the stanza holding that backend's connection details. Changing the backend therefore requires both the authType value and a corresponding settings stanza.

Question 39Configuration Files

In authorize.conf, which attribute of a [role_<name>] stanza lists the indexes that the role may search?

  1. searchableIndexes
  2. indexesAllowed
  3. srchIndexesDefault
  4. srchIndexesAllowed Correct answer.

Explanation

srchIndexesAllowed defines the complete set of indexes a role can search and supports wildcards. srchIndexesDefault only decides which of those allowed indexes are searched when a user does not name an index explicitly.

Question 40Configuration Files

Which props.conf setting supplies the regular expression that tells Splunk where one event ends and the next begins when line merging is enabled?

  1. LINE_BREAKER Correct answer.
  2. TIME_PREFIX
  3. BREAKER_REGEX
  4. EVENT_BREAKER

Explanation

LINE_BREAKER is the regex whose capturing group matches the text, usually a leading timestamp, that begins a new event. It is applied only when SHOULD_LINEMERGE is set to true for that stanza.

Question 41Configuration Files

Which server.conf attribute must hold the same value on the cluster master and on every peer node so that they can communicate?

  1. pass4SymmKey Correct answer.
  2. sharedKey
  3. clusterSecret
  4. authToken

Explanation

pass4SymmKey is the shared secret used in the clustering stanza to authenticate traffic between cluster components. If a peer's value differs from the master's, the peer cannot join the cluster.

Question 42Configuration Files

In deploymentclient.conf, which attribute of the [target-broker:deploymentServer] stanza holds the deployment server address?

  1. targetUri Correct answer.
  2. serverUri
  3. phoneHomeUri
  4. brokerUri

Explanation

The deployment client reads the deployment server location from targetUri inside a target-broker stanza. The value is given as host:port, for example deployment01:8089.

Question 43Configuration Files

Which savedsearches.conf attribute schedules a saved search using a cron expression?

  1. cron_expr
  2. schedule
  3. time_window
  4. cron_schedule Correct answer.

Explanation

cron_schedule holds a standard five-field cron string that determines when the search runs. The schedule only fires when enableSched is also set to 1 in the same stanza.

Question 44Configuration Files

An administrator must change a value that ships in $SPLUNK_HOME/etc/system/default/props.conf. What is the correct approach?

  1. Delete the default file so Splunk regenerates it with the new value.
  2. Add the stanza with the new value to $SPLUNK_HOME/etc/system/local/props.conf. Correct answer.
  3. Set the value in indexes.conf, which takes priority over props.conf.
  4. Edit the stanza directly in the system/default file and restart Splunk.

Explanation

Files under default directories are replaced during upgrades and should never be edited. Overrides belong in a local directory, which takes precedence over the shipped default files.

Question 45Configuration Files

Which setting assigns a specific sourcetype to a single monitored file path?

  1. The sourcetype attribute in the inputs.conf monitor stanza Correct answer.
  2. The SOURCE_KEY attribute in transforms.conf
  3. The sourcetype attribute in the outputs.conf tcpout stanza
  4. The sourcetype attribute in the props.conf stanza for the current sourcetype

Explanation

inputs.conf sets sourcetype on the input itself, so the assignment applies to that path alone. The resulting sourcetype then determines which props.conf stanza's parsing rules are used.

Question 46Configuration Files

Which props.conf setting applies a transforms.conf stanza to extract fields at search time?

  1. REPORT-<class> Correct answer.
  2. LOOKUP-<class>
  3. EXTRACT-<class>
  4. TRANSFORMS-<class>

Explanation

REPORT-<class> points to a transform that runs during search, which is appropriate for most field extractions. TRANSFORMS-<class> is the index-time equivalent and only writes indexed fields when the transform sets WRITE_META.

Question 47Configuration Files

Which DEST_KEY value in transforms.conf sends matched events to a different index during index-time processing?

  1. _raw
  2. _MetaData:Index Correct answer.
  3. _MetaData:Sourcetype
  4. _time

Explanation

Setting DEST_KEY to _MetaData:Index and FORMAT to the target index name rewrites the destination index for matching events. The transform only takes effect when props.conf references it through TRANSFORMS-<class> for that source or sourcetype.

Question 48Configuration Files

Which indexes.conf attribute determines the size at which a hot bucket rolls to warm?

  1. maxDataSize Correct answer.
  2. maxHotBuckets
  3. maxMemMB
  4. rotatePeriodInSecs

Explanation

maxDataSize sets the target bucket size, either in megabytes or with values such as auto and auto_high_volume. When a hot bucket reaches that size it rolls to warm and a new hot bucket is created.

Question 49Configuration Files

An index is configured with frozenTimePeriodInSecs = 86400 and maxTotalDataSizeMB = 500000. When is data in that index frozen?

  1. When whichever of the two retention limits is reached first Correct answer.
  2. Only when both retention limits are reached at the same moment
  3. Only after the index has been disabled and re-enabled by an administrator
  4. When the size limit is reached, because a size budget overrides an age policy

Explanation

Retention settings act independently, and the first limit reached triggers freezing of the oldest buckets. Neither limit waits for the other, and neither disables the other.

Question 50Configuration Files

A user changes a search-related setting from Splunk Web. Where is that change stored, and how does it rank against other configuration layers?

  1. In etc/system/default, which ranks above app local files
  2. In etc/system/local, which outranks every other directory
  3. In etc/apps/<app>/local, which ranks below system/default
  4. In etc/users/<user>/<app>/local, which outranks app and system files Correct answer.

Explanation

User-specific preferences are written under the user's own directory in the users tree. That user layer is consulted before app layers and the system layer, so it wins for that user only.