I85PREP
⌘ K
Splunk Core Certified User study materials
Splunk Core Certified User study resources

Splunk Core Certified User practice questions

One question at a time. Build your Splunk Core Certified User understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Splunk Components and Architecture

What is the primary function of an indexer in a Splunk Enterprise deployment?

  1. Manages the license pool shared by the whole deployment
  2. Serves the web interface where users run their searches
  3. Distributes apps and configuration bundles to forwarders
  4. Parses incoming data and writes it to disk as index buckets Correct answer.

Explanation

Indexers sit at the end of the data pipeline and are responsible for parsing raw data and writing it to disk as index buckets, then serving search requests against those buckets. The web interface, app distribution, and licensing are handled by other components.

Question 2Splunk Components and Architecture

What is the role of a search head in a distributed Splunk deployment?

  1. It collects data from endpoints and forwards it to the indexing tier
  2. It runs searches across indexers and merges the results Correct answer.
  3. It stores raw events in hot and warm buckets on local disk
  4. It allocates license volume across all instances in the deployment

Explanation

A search head receives user searches, distributes them to the indexers (search peers), and consolidates the partial results into a single result set for the user. It does not normally store the indexed data itself.

Question 3Splunk Components and Architecture

Which statement best describes a universal forwarder?

  1. A web interface that gives users a search bar but performs no indexing or forwarding
  2. A lightweight agent that collects data and forwards it to another Splunk instance Correct answer.
  3. A full Splunk Enterprise instance that parses data and writes it to local index buckets for searching
  4. A management component that coordinates indexer replication and maintains the search factor

Explanation

The universal forwarder is a small-footprint agent that collects data and sends it to another Splunk instance, typically an indexer or a heavy forwarder. It does not include the full search and indexing stack and has no Splunk Web interface.

Question 4Splunk Components and Architecture

Which port does an indexer listen on by default to receive data from forwarders?

  1. 8089
  2. 9997 Correct answer.
  3. 514
  4. 8000

Explanation

Forwarders send data to indexers over the Splunk-to-Splunk port, which defaults to 9997. Port 8000 is the web interface, port 8089 is the management/REST interface, and 514 is commonly used for syslog.

Question 5Splunk Components and Architecture

Which pair correctly matches Splunk Web and the splunkd management interface to their default ports?

  1. Splunk Web on 8000 and splunkd management on 8089 Correct answer.
  2. Splunk Web on 8089 and splunkd management on 8000
  3. Splunk Web on 8089 and splunkd management on 9997
  4. Splunk Web on 8000 and splunkd management on 9997

Explanation

Splunk Web listens on 8000 by default, while the splunkd management and REST interface listens on 8089. Port 9997 is used for receiving forwarded data, not for the management interface.

Question 6Splunk Components and Architecture

What is the primary role of the deployment server?

  1. Coordinating bucket replication across the indexer peers
  2. Storing indexed data in hot, warm, and cold buckets for searching
  3. Distributing configuration and apps to forwarders and other deployment clients Correct answer.
  4. Balancing search load across the members of a search head cluster

Explanation

The deployment server acts as a central configuration manager, pushing apps and configuration content to deployment clients such as universal and heavy forwarders. It does not store index data, manage replication, or balance search load.

Question 7Splunk Components and Architecture

Which component coordinates replication in an indexer cluster and tells peers which buckets to hold?

  1. Deployer
  2. Search head captain
  3. License manager
  4. Cluster master Correct answer.

Explanation

The cluster master manages the indexer cluster: it tracks peers, assigns bucket replication, and enforces the replication and search factors. It does not store data itself.

Question 8Splunk Components and Architecture

Which component pushes apps and configuration updates to the members of a search head cluster?

  1. Monitoring Console
  2. Cluster master
  3. Deployment server
  4. Deployer Correct answer.

Explanation

Search head cluster members are managed by a deployer, which distributes apps and configuration bundles to them. The deployment server is used for forwarders and other deployment clients, not for search head cluster members.

Question 9Splunk Components and Architecture

Which sequence shows the normal lifecycle of a Splunk index bucket as it ages?

  1. Cold, hot, warm, frozen
  2. Hot, cold, warm, frozen
  3. Hot, warm, cold, frozen Correct answer.
  4. Warm, hot, cold, frozen

Explanation

A bucket starts hot while it is being written, rolls to warm when it is no longer written to, later moves to cold storage, and finally rolls to frozen. The frozen state is where the bucket leaves the index.

Question 10Splunk Components and Architecture

What happens to an index bucket when it rolls to the frozen state?

  1. It is retired from the index and deleted unless archiving is configured Correct answer.
  2. It becomes read-only but remains searchable in the index indefinitely
  3. It is re-ingested into the warm state so its events can be searched again
  4. It is merged with the hot bucket to reduce the number of buckets on disk

Explanation

When a bucket reaches the frozen state it is removed from the index. By default the data is deleted, but archiving can be configured so the bucket is preserved outside the index.

Question 11Splunk Components and Architecture

What is the thawed bucket state used for?

  1. Holding newly received events before they are parsed and indexed
  2. Restoring an archived bucket so its data is searchable again Correct answer.
  3. Caching search results returned by the indexers to the search head
  4. Storing bucket summaries used to accelerate report searches

Explanation

Thawing restores a previously archived (frozen) bucket into the index so its events can be searched again. Newly received events go into hot buckets, not thawed ones.

Question 12Splunk Components and Architecture

Which list gives the three stages of the Splunk data pipeline in the correct order?

  1. Input, indexing, parsing
  2. Input, parsing, indexing Correct answer.
  3. Indexing, input, parsing
  4. Parsing, indexing, input

Explanation

Data first enters the pipeline at the input stage, is then parsed into individual events and fields, and finally is written to disk during indexing. The search pipeline operates later, on the indexed data.

Question 13Splunk Components and Architecture

How does a heavy forwarder differ from a universal forwarder?

  1. It is a full Splunk instance that can parse, filter, and route data before forwarding it Correct answer.
  2. It has no configuration files and is managed only through the license manager
  3. It replaces the indexers by storing the data in its own hot and warm buckets
  4. It can only forward raw files and has no ability to process or filter events before sending them

Explanation

A heavy forwarder is a full Splunk Enterprise instance with the indexing pipeline disabled for storage purposes, so it can parse, filter, and route events before forwarding. A universal forwarder is a lightweight agent with far less processing capability.

Question 14Splunk Components and Architecture

What is the role of the license manager in a Splunk deployment?

  1. It measures search performance and sends the results to the monitoring console
  2. It stores the license and controls license usage across the deployment Correct answer.
  3. It indexes license-related events into a dedicated internal index
  4. It distributes license keys to forwarders in the form of apps

Explanation

The license manager holds the license and monitors indexing volume across the instances that report to it, enforcing the terms of the license. Forwarders send license usage information rather than receiving license keys.

Question 15Splunk Components and Architecture

Which license type is intended for instances that only forward data and do not search?

  1. Forwarder license Correct answer.
  2. Trial license
  3. Free license
  4. Enterprise license

Explanation

The forwarder license is designed for universal and heavy forwarders that only send data onward and do not run searches. The Enterprise, Free, and Trial licenses are associated with instances that index and search data.

Question 16Splunk Components and Architecture

Which statement describes a standalone Splunk Enterprise deployment?

  1. A single instance performs both indexing and search functions Correct answer.
  2. One indexer cluster with a separate search head tier
  3. A search head cluster managed by a dedicated deployer
  4. A distributed deployment with dedicated forwarders and indexers

Explanation

In a standalone deployment, one Splunk Enterprise instance handles input, indexing, and search, making it suitable for small environments and testing. Distributed deployments split these roles across separate components.

Question 17Splunk Components and Architecture

In distributed search, what are the indexers that a search head sends searches to called?

  1. Forwarder groups
  2. License pools
  3. Search peers Correct answer.
  4. Deployment clients

Explanation

A search head configured for distributed search sends its search requests to indexers known as search peers. Deployment clients are instances that receive apps from a deployment server.

Question 18Splunk Components and Architecture

In an indexer cluster with a replication factor of 3 and a search factor of 2, what is guaranteed?

  1. Each bucket is searchable on all three peers at the same time
  2. Each bucket has three copies, and two of them are searchable Correct answer.
  3. Each bucket has three searchable copies and two archived copies
  4. Each bucket has two copies, and all three of them are searchable

Explanation

The replication factor sets the total number of copies of each bucket, and the search factor sets how many of those copies are searchable. With RF=3 and SF=2, three copies exist and two of them can serve searches.

Question 19Splunk Components and Architecture

Which component provides a centralized view of health, performance, and license usage across a Splunk deployment?

  1. Deployment server
  2. Cluster master
  3. Deployer
  4. Monitoring Console Correct answer.

Explanation

The Monitoring Console aggregates health, performance, and license information from the instances in a deployment and presents it in dashboards. Other components have narrower management responsibilities.

Question 20Splunk Components and Architecture

Which process is the core Splunk daemon that handles indexing, searching, and forwarding?

  1. splunkweb
  2. btool
  3. splunkd Correct answer.
  4. mongod

Explanation

splunkd is the main Splunk process that performs indexing, searching, and forwarding operations. Splunk Web is a separate front-end process that communicates with splunkd.

Question 21Splunk Components and Architecture

In indexes.conf, which setting specifies the directory where cold buckets for an index are stored?

  1. homePath
  2. thawedPath
  3. maxTotalDataSizeMB
  4. coldPath Correct answer.

Explanation

coldPath holds the index's cold buckets, while homePath holds its hot and warm buckets and thawedPath holds restored buckets. maxTotalDataSizeMB is a size limit, not a storage location.

Question 22Splunk Components and Architecture

Which pair of configuration files on an indexer controls event processing and field extraction at index time?

  1. indexes.conf and limits.conf
  2. server.conf and web.conf
  3. inputs.conf and outputs.conf
  4. props.conf and transforms.conf Correct answer.

Explanation

props.conf defines settings such as line breaking and timestamp recognition, and transforms.conf defines the regex-based transformations and field extractions those settings reference. inputs.conf and outputs.conf govern data flow rather than processing rules.

Question 23Splunk Components and Architecture

Which configuration file on a forwarder specifies the destination indexers that data is sent to?

  1. inputs.conf
  2. props.conf
  3. outputs.conf Correct answer.
  4. server.conf

Explanation

outputs.conf defines the receiving destinations, such as indexers or another forwarder, along with how data is sent to them. inputs.conf defines the data sources instead.

Question 24Splunk Components and Architecture

What is the role of the captain in a search head cluster?

  1. It stores replicated index buckets on behalf of the cluster members
  2. It coordinates knowledge object replication and search scheduling across members Correct answer.
  3. It distributes apps and configuration updates to the members
  4. It manages the shared license pool for the cluster members

Explanation

The captain is an elected member that coordinates the replication of knowledge objects and the scheduling of searches across the cluster. App distribution to members is handled separately by the deployer.

Question 25Splunk Components and Architecture

What happens when a Splunk deployment exceeds its licensed daily indexing volume?

  1. Search can be disabled until usage returns within the licensed volume Correct answer.
  2. The deployment server downgrades the license to Free until the next day
  3. Indexers immediately stop accepting data and delete the excess buckets
  4. Forwarders are automatically removed from their hosts by the deployment server

Explanation

The license manager tracks daily indexing volume and issues warnings when the limit is exceeded; if the overage persists, a license violation is recorded and search can be disabled until usage returns within the licensed volume. Data is not automatically deleted and forwarders are not uninstalled.

Question 26Splunk Components and Architecture

By default, which port does a Splunk indexer listen on to receive data from forwarders?

  1. 8089
  2. 514
  3. 9997 Correct answer.
  4. 8000

Explanation

When you enable receiving on an indexer, splunktcp listens on port 9997 by default, which is the standard destination for forwarder traffic. Other default ports serve different roles, so identifying the data-receiving port is key when configuring forwarders.

Question 27Splunk Components and Architecture

Which default port does splunkd use for management traffic such as CLI commands, REST API calls, and deployment client requests?

  1. 8000
  2. 443
  3. 9997
  4. 8089 Correct answer.

Explanation

splunkd exposes its management interface on port 8089 by default, and this port carries REST API calls, CLI connections to remote instances, and deployment client communications with a deployment server. It is distinct from the port used to receive raw data.

Question 28Splunk Components and Architecture

Which component in a distributed deployment stores the incoming data, indexes it, and runs searches against the data it holds?

  1. Search head
  2. Indexer Correct answer.
  3. Deployment server
  4. Universal forwarder

Explanation

Indexers are the components that receive raw data, write it into buckets on disk, and execute the search portions that the search head dispatches to them. The other components handle collection, search coordination, or configuration distribution rather than data storage.

Question 29Splunk Components and Architecture

Which statement accurately describes a universal forwarder?

  1. It can serve as the search head for a distributed deployment
  2. It parses events and writes them to index buckets before forwarding
  3. It runs Splunk Web so users can search data locally
  4. It collects data and forwards it using minimal system resources Correct answer.

Explanation

The universal forwarder is a lightweight, dedicated agent that monitors inputs and sends data onward, consuming far fewer resources than a full Splunk Enterprise instance. It has no Splunk Web interface, no indexing capability, and no search capability.

Question 30Splunk Components and Architecture

Universal forwarders send data to indexers in a standard distributed deployment. Where does event parsing, such as event breaking and timestamp extraction, normally occur?

  1. On the deployment server
  2. On the universal forwarders
  3. On the indexers Correct answer.
  4. On the search heads

Explanation

Because a universal forwarder performs only minimal processing, parsing tasks such as event breaking and timestamp recognition are normally carried out by the indexers that receive the data. A heavy forwarder is the component that can move parsing earlier in the pipeline when that is required.

Question 31Splunk Components and Architecture

What is the main purpose of an intermediate forwarder?

  1. To provide a web interface for searching forwarded data
  2. To aggregate traffic from many forwarders so fewer hosts connect directly to indexers Correct answer.
  3. To store indexed data when downstream indexers are unavailable
  4. To distribute apps and configurations to other forwarders

Explanation

An intermediate forwarder sits between data sources and indexers, consolidating the traffic of many forwarders so that only a small number of hosts need network access to the indexers. It forwards data rather than indexing, searching, or managing configurations.

Question 32Splunk Components and Architecture

What is the primary role of a search head in a distributed deployment?

  1. Receiving data from forwarders and indexing it
  2. Distributing search requests to indexers and consolidating the results Correct answer.
  3. Storing raw events on local disk
  4. Managing licenses and usage reporting

Explanation

A search head takes user searches, dispatches them to the relevant indexers, and merges the partial results into a final result set for the user. It does not store primary data or receive forwarded streams.

Question 33Splunk Components and Architecture

Which process is responsible for serving the Splunk Web interface and passing user requests to the core daemon?

  1. splunkweb Correct answer.
  2. mongod
  3. splunkd-ulimit
  4. splunkd

Explanation

splunkweb is the separate process that renders the Splunk Web interface and relays requests to splunkd, which performs the actual work. Splunk Web can be disabled without affecting indexing, searching, or forwarding.

Question 34Splunk Components and Architecture

By default, where does a Splunk Enterprise indexer store its index data?

  1. $SPLUNK_HOME/etc/system/local
  2. $SPLUNK_HOME/etc/apps
  3. $SPLUNK_HOME/bin
  4. $SPLUNK_HOME/var/lib/splunk Correct answer.

Explanation

The default index location, normally set by the path directive in indexes.conf, is $SPLUNK_HOME/var/lib/splunk, where per-index bucket directories are created. The other paths hold applications, local configuration, and executables.

Question 35Splunk Components and Architecture

What does the term schema-on-the-fly describe in Splunk?

  1. Fields must be defined in a schema before data can be indexed
  2. Fields are extracted from events at search time rather than being required at index time Correct answer.
  3. The indexer rewrites every event into a fixed relational schema
  4. Splunk converts all incoming events into JSON during indexing

Explanation

Splunk stores events largely as they arrive and applies field extraction at search time, so no rigid schema must be declared in advance. This lets new questions be asked of existing data without reindexing it.

Question 36Splunk Components and Architecture

When an event is indexed without a specified destination index, which index does Splunk write it to by default?

  1. _internal
  2. _audit
  3. summary
  4. main Correct answer.

Explanation

The main index is the default destination when no other index is designated by the input stanza or by a transform. The underscore-prefixed indexes hold Splunk's own internal logs, audit records, and summary data.

Question 37Splunk Components and Architecture

Which phase of the Splunk data pipeline writes events into index buckets on disk?

  1. Queueing
  2. Parsing
  3. Input
  4. Indexing Correct answer.

Explanation

The data pipeline moves events through input, parsing, and indexing; the indexing phase is where processed events are written into buckets on disk and made searchable. Parsing readies the events, but storage occurs in the indexing phase.

Question 38Splunk Components and Architecture

With SmartStore enabled on an indexer cluster, where does the bulk of indexed data reside?

  1. In the search head cluster's replicated storage
  2. On the cluster manager's local disk
  3. In a remote object store, with a local cache for buckets in active use Correct answer.
  4. Only on the local disk of each peer

Explanation

SmartStore moves bucket storage to a remote object store such as Amazon S3 or an equivalent, while indexers keep a local cache of the buckets currently being searched or written. This reduces the local storage each indexer must maintain.

Question 39Splunk Components and Architecture

A deployment needs forwarders to learn the current list of indexers automatically from the cluster manager instead of using hard-coded peer addresses. Which feature accomplishes this?

  1. SmartStore
  2. License pooling
  3. Indexer discovery Correct answer.
  4. Bucket fixup

Explanation

Indexer discovery lets forwarders query the cluster manager for the active list of peers and use that list in their outputs configuration, so forwarders adapt as cluster membership changes. It removes the need to maintain static peer addresses on every forwarder.

Question 40Splunk Components and Architecture

What is the purpose of the fishbucket index?

  1. It records file read positions and checksums so the same data is not indexed twice Correct answer.
  2. It stores internal logs generated by the indexing pipeline
  3. It keeps license usage records for auditing purposes
  4. It holds copies of buckets replicated from other peers

Explanation

The fishbucket, named _thefishbucket in current releases, tracks the read offset and cyclic redundancy check for each monitored file. When a forwarder or indexer restarts, it consults this state so it resumes where it left off instead of re-sending already indexed data.

Question 41Navigating the Splunk Interface

By default, which port does Splunk Web listen on so users can open the interface in a browser?

  1. 8000 Correct answer.
  2. 514
  3. 9997
  4. 8089

Explanation

Splunk Web is the browser-based interface and serves HTTP on port 8000 by default. Port 8089 is used by splunkd for management and REST calls, while 9997 and 514 are used for data ingestion.

Question 42Navigating the Splunk Interface

Which interface element runs across the top of Splunk Web and holds the app menu, Settings, Messages, Activity, Help, and the user account menu?

  1. The app navigation bar
  2. The fields sidebar
  3. The timeline
  4. The Splunk bar Correct answer.

Explanation

The Splunk bar is the global top bar that stays visible across apps and provides account-level and system-level menus. App-specific links and search-related panels sit elsewhere on the page.

Question 43Navigating the Splunk Interface

Which element lists the views available in the currently selected app, such as Search, Reports, and Dashboards?

  1. App navigation bar Correct answer.
  2. Timeline histogram panel
  3. Fields sidebar
  4. Splunk bar

Explanation

Each app defines its own navigation bar, usually on the left, containing links to that app's views. It changes when you switch apps, unlike the persistent Splunk bar.

Question 44Navigating the Splunk Interface

Which app ships with Splunk Enterprise and serves as the standard place to run searches and build reports?

  1. The Monitoring Console app
  2. The Search & Reporting app Correct answer.
  3. The Launcher app
  4. The Dashboards app

Explanation

The Search & Reporting app is installed by default and is the typical landing app where users search, save reports, and create dashboards. Other apps are optional or specialized.

Question 45Navigating the Splunk Interface

What time range is applied by default when you open a new search in Splunk Web?

  1. Last 24 hours Correct answer.
  2. Today
  3. Last 60 minutes
  4. All time

Explanation

A new search starts with the time range picker set to Last 24 hours, which limits results to the most recent day. You must change the picker to search a wider or narrower window.

Question 46Navigating the Splunk Interface

Which search mode is selected by default and balances search speed with field extraction?

  1. Smart Correct answer.
  2. Verbose
  3. Fast
  4. Full

Explanation

Smart mode is the default because it behaves like Fast mode when no transforming commands are used and switches to fuller field extraction when they are. Fast and Verbose are the other two supported modes.

Question 47Navigating the Splunk Interface

In the fields sidebar, what best describes a field listed under Interesting Fields?

  1. A field you pinned to the sidebar yourself
  2. A field that contains only numeric values
  3. A field Splunk found in many events Correct answer.
  4. A field that appears in every single event

Explanation

Splunk automatically surfaces fields it extracts from a meaningful share of the returned events as interesting fields. Fields you add yourself become selected fields and remain in the sidebar for the current search.

Question 48Navigating the Splunk Interface

Which control lets you save the results of a completed search as a report, an alert, or a dashboard panel?

  1. Print
  2. Save As Correct answer.
  3. Export
  4. Share

Explanation

The Save As menu turns the current search into a reusable object such as a report, a scheduled alert, a dashboard panel, or an event type. Export and Print only output the results.

Question 49Navigating the Splunk Interface

Where do you open the Job Inspector to review details such as run time and number of events scanned?

  1. From the Activity menu > Preferences
  2. From the fields sidebar
  3. From Settings > Server settings > Licensing
  4. From the job menu on the search bar Correct answer.

Explanation

The search job menu next to the search bar exposes Inspect Job, which opens the Job Inspector with timing, cost, and search metadata. It applies to the specific job you just ran.

Question 50Navigating the Splunk Interface

What does the Find feature in the Splunk bar search for?

  1. Raw events across all indexes
  2. Users and roles in the authentication store
  3. Splunk objects like dashboards and reports Correct answer.
  4. Fields in the current search results

Explanation

Find is an object search that locates saved knowledge and content such as dashboards, reports, alerts, and lookups you have permission to see. It does not search raw event data.