Free SPLK-1005 Practice Test Questions and Answers (2026)

The regex replacement processor runs in the parsing pipeline. During the data ingestion process, the parsing pipeline is responsible for breaking the data stream into individual events, identifying timestamps, and applying data transformations. These transformations, which include regex replacements defined in transforms.conf and invoked by props.conf, modify the raw event data before it is passed to the indexing pipeline to be written to disk. This ensures that data is structured and cleaned according to specified rules at index-time.

A. Merging pipeline: This is part of the search pipeline, which merges results from index buckets during a search; it does not process raw incoming data.

B. Typing pipeline: This is also part of the search pipeline, responsible for event typing and search-time field extraction, not index-time data transformation.

C. Index pipeline: This pipeline takes the processed events from the parsing pipeline and writes them to the on-disk indexes; transformations have already occurred.

1. Splunk Enterprise Documentation, Getting Data In manual: "Overview of the Splunk Enterprise data pipeline". This document outlines the stages of data processing. It states, "During parsing, Splunk Enterprise breaks the data into events... It also applies transformations to the data." This explicitly places transformations within the parsing stage.

2. Splunk Enterprise Documentation, Knowledge Manager Manual: "transforms.conf". The REGEX attribute in a transforms.conf stanza is used to define a regular expression for matching and replacement. These transforms are applied at index time during the parsing phase.

3. Splunk Enterprise Documentation, Knowledge Manager Manual: "props.conf". The TRANSFORMS- attribute is used to specify which transformations (defined in transforms.conf) to apply to a given sourcetype. The documentation confirms this is an index-time operation that occurs during the parsing stage of the data pipeline.

Splunk Cloud Platform is a managed service that requires a stringent vetting process for all applications to ensure security, performance, and stability. Only apps that have been evaluated and approved by Splunk are supported for installation. This process, known as "Cloud vetting," verifies that an app's code and functionality are compatible with the Splunk Cloud architecture and do not pose a risk to the environment. Apps that pass this process are marked as "Cloud-vetted" on Splunkbase and are then made available for installation.

A. Premium apps, such as Splunk Enterprise Security (ES) or IT Service Intelligence (ITSI), require installation by Splunk Support due to complex configurations and licensing.

C. Not all apps compatible with on-prem Splunk Enterprise are supported on Splunk Cloud due to architectural differences and security restrictions, such as limitations on file system access.

D. Self-service installation is only available for public apps on Splunkbase that have been specifically vetted and approved for Splunk Cloud, not for all apps.

---

1. Splunk Cloud Platform Admin Manual, "Install apps in Splunk Cloud Platform".

Section: App installation process for Splunk Cloud Platform

Content: "For security and operational reasons, Splunk Cloud Platform supports a curated set of Splunkbase apps that have been vetted for Splunk Cloud Platform. Apps that pass the vetting process are designated as 'Cloud-vetted' on Splunkbase." This directly supports the correctness of option B and refutes options C and D.

2. Splunk Developer Portal Documentation, "Vet your app for Splunk Cloud Platform".

Section: About app vetting for Splunk Cloud Platform

Content: "Splunk vets all apps for Splunk Cloud Platform to ensure that they do not pose a security risk or negatively impact the performance and health of the stack." This reinforces the reasoning for option B.

3. Splunk Enterprise Security Documentation, "Install and Upgrade Splunk Enterprise Security".

Section: Install Splunk Enterprise Security in a Splunk Cloud Platform environment

Content: "To install Splunk Enterprise Security in a Splunk Cloud Platform environment, file a support case." This confirms that premium apps are not self-service installed, refuting option A.

Splunk Cloud Platform is a managed service where Splunk handles the backend infrastructure and administration. To maintain the stability, security, and performance of the multi-tenant environment, customers are provided with access to a curated and supported subset of the full Splunk Enterprise REST API. This allows customers to perform necessary administrative and operational tasks programmatically—such as managing users, running searches, and interacting with knowledge objects—without exposing endpoints that could compromise the integrity of the service.

A. The REST API management port (typically 8089) and the Splunk HTTP Event Collector (HEC) port (typically 443) are distinct and separate services in Splunk Cloud.

B. For security and platform stability, Splunk does not expose all REST API endpoints; many are restricted and reserved for internal Splunk operations.

C. The REST API is a key feature and is available in Splunk Cloud, although it is a more limited subset compared to Splunk Enterprise.

---

1. Splunk Cloud Platform, REST API Tutorials Manual, "Introduction to the Splunk Cloud Platform REST API".

The manual explicitly states: "The Splunk Cloud Platform REST API provides a subset of the Splunk Enterprise REST API endpoints for interacting with Splunk Cloud Platform." This directly supports the correct answer (D) and refutes options B and C.

2. Splunk Cloud Platform, Admin Manual, "REST API access and authentication".

This section details: "The Splunk Cloud Platform REST API is based on the Splunk Enterprise REST API, but does not support all of the same endpoints and features." This confirms that only a subset of endpoints is available.

3. Splunk Cloud Platform, Service Description, "Splunk Cloud Platform Components".

This document outlines the service architecture, implicitly differentiating between customer-facing management interfaces like the API and HEC, and the underlying infrastructure managed by Splunk. It clarifies the port differences, showing that the management port (for REST API) and HEC port are not the same, which refutes option A. For example, it lists the default management port as 8089 and the HEC port as 443.

The recommended method is to create and use a dedicated test index. This approach isolates the new, unverified data from the production environment, preventing potential data quality issues, license impact from misconfigured timestamps, or the triggering of false alerts. Using a test index on the production Splunk instance allows administrators to validate the entire data pipeline—including parsing, event breaking, and field extractions—with the actual production configuration (e.g., search heads, indexers) before finalizing the input to use the correct production index. This is a standard, low-overhead best practice for ensuring data quality.

B. Sending data directly to a production index is risky as it can pollute the index with poorly formatted or incorrect data, impacting reports and alerts.

C. While a full test environment is a valid strategy for large-scale changes, it is often unnecessarily complex and resource-intensive for simply validating a new data source.

D. There is no standard, recognized index named "chance" in Splunk; this is an invalid option.

---

1. Splunk Enterprise Documentation, Getting Data In Manual: In the section on managing indexes, the manual explicitly recommends this practice. It states, "To avoid polluting your production indexes with test data, create one or more test indexes. Use these indexes to test new data inputs before you roll them out to production."

Source: Splunk Enterprise Documentation, Getting Data In, "Create and manage indexes", "Best practice: Use test indexes".

2. Splunk Enterprise Documentation, Splunk Validated Architectures: This guide on best practices for Splunk deployment reinforces the concept of controlled data onboarding. It emphasizes validating configurations in a manner that does not impact the production operational state, for which using a test index is a primary method.

Source: Splunk Validated Architectures, "Reference Environment: Core Splunk Enterprise", Section on "Deployment Process".

3. Splunk Education, Splunk Enterprise System Administration Courseware: This official training course teaches administrators to use a non-production index (e.g., testevents) when configuring a new inputs.conf stanza. This allows for verification of the data's appearance in Splunk Search before committing it to a production index.

Source: Splunk Enterprise System Administration Course Manual, Module on "Configuring Forwarders and Receiving Data".

Splunk Cloud Platform is a managed service where Splunk is responsible for managing the underlying infrastructure, including capacity and core configurations. Customers do not have direct access to modify their subscription's capacity (e.g., storage, license size) or alter certain backend configurations. These types of changes fundamentally alter the service agreement and resource allocation. Therefore, a customer administrator must always contact Splunk Support or their sales representative to initiate such modifications. The other options represent common operational issues that a Splunk Cloud administrator is typically expected to troubleshoot and often resolve without needing to engage Splunk Support.

B. Search issues can often be resolved by the administrator by correcting the search syntax, adjusting time ranges, or verifying user permissions.

C. An administrator can typically resolve user login issues by resetting a password, unlocking an account, or troubleshooting the configured authentication method (e.g., SAML).

D. Data indexing problems are frequently due to misconfigurations on the client-side (e.g., forwarders, firewalls, HEC tokens) which an administrator can diagnose and fix.

---

1. Splunk Cloud Platform Service Description: This document outlines the division of responsibilities. Section 2.2, "Splunk Responsibilities," details that Splunk manages the Splunk Cloud Platform infrastructure. Section 2.3, "Subscription Modifications," states, "Customer may request to modify its Subscription (e.g., increase Data Ingestion or Storage capacity)... by contacting its Splunk sales representative." This confirms that capacity changes are not self-service and require contacting Splunk.

Source: Splunk Cloud Platform Service Description, Version dated 2023-10-01, Sections 2.2 & 2.3.

2. Splunk Cloud Platform Admin Manual: This manual details the tasks a Splunk Cloud administrator can perform. It includes sections on managing users and roles, data inputs, and app management. The absence of sections on managing infrastructure capacity (like storage tiers or license volume) reinforces that these tasks are outside the administrator's control and are managed by Splunk.

Source: Splunk Cloud Platform Admin Manual, "Administer Splunk Cloud Platform" section.

3. Troubleshooting Manual for Splunk Enterprise (principles apply to Cloud): This manual provides guidance for administrators on diagnosing common issues, including why a search might not return expected results or why data is not being indexed. This demonstrates that these are considered standard administrative troubleshooting tasks.

Source: Splunk Enterprise Troubleshooting Manual, "Introduction to troubleshooting Splunk" and subsequent chapters on search and data input issues.

Splunk Enterprise is configured to execute scripts from specific, predefined directories to ensure security and proper functionality. The two primary, officially documented locations are $SPLUNKHOME/bin/scripts for global scripts and $SPLUNKHOME/etc/apps//bin for application-specific scripts. These paths are used for functionalities like scripted inputs, alert actions, and custom search commands. The path SPLUNKHOME/etc/scripts/local is not a standard directory that Splunk monitors for executable scripts. The etc directory is reserved for configuration files, lookups, and application structures, and does not natively contain a scripts subdirectory for execution purposes.

A. SPLUNKHOME/etc/system/bin

This is not a standard location for user-defined scripts like scripted inputs or alerts. Splunk does not look in this directory by default for script execution.

B. SPLUNKHOME/etc/apps//bin

This is a correct and standard path. It is the designated location for scripts that are part of a specific Splunk application or add-on.

D. SPLUNKHOME/bin/scripts

This is a correct and standard path. It serves as the global directory for scripts that are not associated with any particular application.

1. Splunk Enterprise Documentation, Admin Manual, "Create a scripted input in Splunk Web".

Reference: In the "Prerequisites" section, the documentation explicitly states: "Place your script in an appropriate directory. Scripts can be located in $SPLUNKHOME/etc/apps//bin or $SPLUNKHOME/bin/scripts." This confirms that options B and D are valid paths, and by omission, that other paths are not standard.

2. Splunk Enterprise Documentation, Alerting Manual, "Set up a script for an alert action".

Reference: Under the "Create a script" section, step 1 directs the user: "Save the script file to either $SPLUNKHOME/bin/scripts or $SPLUNKHOME/etc/apps//bin." This further validates that B and D are the correct locations for alert action scripts.

3. Splunk Enterprise Documentation, Search Manual, "Make your script available to Splunk Search".

Reference: This section on creating custom search commands specifies: "The script must be in $SPLUNKHOME/etc/apps//bin." This confirms option B is a valid path for this specific script type.

Splunk Cloud Platform is delivered with four predefined roles: user, power, apps, and scadmin. These roles are created automatically in every Splunk Cloud tenant and provide the starting point for all role‐based access control. Option C lists three of these built-in roles (apps, power, scadmin) and therefore represents the correct set taken from the default catalogue. The other options introduce roles (admin, mustdelete, can delete, users) that are either Enterprise-only or internal service roles that are not available for assignment to Splunk Cloud users.

A. mustdelete, power, scadmin – “mustdelete” is an Enterprise-only internal role; not present or assignable in Splunk Cloud.

B. power, user, admin – “admin” is disabled for customers in Splunk Cloud; scadmin replaces it, so this trio is not the default set.

D. can delete, users, admin – None of these role names (spacing/case) match the actual predefined Cloud roles; “admin” again is not customer-assignable.

1. Splunk Cloud Platform Admin Manual, “Define user roles”, Table 1 – Predefined roles (user, power, apps, scadmin). Splunk Documentation 9.1.2308, doc ID scuserroles.

2. Splunk Cloud Platform Service Description, §4.2 “Role-based access control – default roles”. (June 2023 edition, p. 7).

3. Splunk Cloud Platform Admin Manual, “About accounts and roles”, para 3 (notes that the admin role is reserved for Splunk Support and customers must use scadmin instead).

Splunk Cloud Support should be engaged for technical assistance when a customer has already performed initial troubleshooting and problem isolation but cannot resolve the issue. The support team's primary function is to help with platform-related problems, performance degradation, or service disruptions that are beyond the customer's ability to fix through self-service tools and available documentation. This aligns with the standard industry model for technical support, where support acts as an escalation point for unresolved technical issues.

A. Troubleshooting custom scripted inputs is the customer's responsibility, as Splunk does not support custom code.

B. Many configuration changes, such as creating alerts or dashboards, are self-service and do not require support intervention.

D. Licensing, purchases, and resizing are commercial activities handled by the Splunk sales or account management team, not technical support.

---

1. Splunk Cloud Platform Service Description: In the "Customer Responsibilities" section, it is stated that the customer is responsible for the "Development, testing, and troubleshooting of Customer’s private apps, including any custom scripts." This directly refutes option A. It also states the customer is responsible for the "Configuration of Splunk Cloud Platform features available through the user interface or self-service apps," which refutes the "all configuration changes" in option B.

Source: Splunk Cloud Platform Service Description, Section: Customer Responsibilities.

2. Splunk Support Programs: This document outlines the scope of technical support. It defines support as assistance for "errors in the Software or a failure of the Software to conform to the Documentation." This confirms that support is for unresolved technical issues (Option C). It implicitly excludes commercial activities like purchases and licensing changes (Option D), which are not technical errors.

Source: Splunk Support Programs, Section: 2.1 Scope of Support.

When Splunk is integrated with LDAP for authentication, the best practice is to also use LDAP for authorization by mapping LDAP groups to Splunk roles. In this configuration, the LDAP directory is the single source of truth for user attributes and group memberships. To change a user's role in Splunk, the LDAP administrator must modify the user's group membership on the LDAP server to a group that is mapped to the desired Splunk role (in this case, the 'power' role). Splunk will then automatically assign the new role to the user upon their next login.

B. Users, by default, lack the permissions to change their own roles. Furthermore, any local change would be overridden by the LDAP mapping.

C. The 'power' role is a default role and does not need to be created. Role mapping is done for LDAP groups, not individual user accounts.

D. The Cloud Monitoring Console (CMC) is a tool for monitoring the health and usage of a Splunk Cloud deployment, not for user management or role mapping.

---

1. Splunk Cloud Platform Documentation, Securing Splunk Cloud Platform, "Configure user authentication with LDAP": In the section "Map LDAP groups to Splunk roles," the documentation states, "You can map groups of LDAP users to Splunk roles so that you don't have to create user accounts on the Splunk platform directly... To manage user access, your LDAP administrator adds or removes users from the appropriate groups on the LDAP server." This confirms that role changes are managed within the LDAP directory.

2. Splunk Enterprise Documentation, Securing Splunk Enterprise, "Set up user authentication with LDAP": The principles of LDAP integration are identical between Splunk Enterprise and Splunk Cloud. In the section "Map LDAP groups to Splunk roles," it is explicitly noted, "To change a user's role, your LDAP administrator must change the user's group on the LDAP server." This directly supports the correct answer.

The followTail attribute in inputs.conf is a boolean setting that controls where Splunk software begins reading a monitored file. When set to true, Splunk starts indexing from the end of the file, capturing only new data as it is written. This effectively prevents any data that already exists in the file at the time the monitor is configured from being ingested. This is particularly useful for live log files where only the most recent events are of interest.

A. Pauses a file monitor if the queue is full.

This describes a backpressure or queue management function, which is not controlled by the followTail attribute.

B. Only creates a tail checkpoint of the monitored file.

While Splunk uses checkpoints to track its position, followTail's primary function is to set the initial read position, not just to create a checkpoint.

C. Ingests a file starting with new content and then reading older events.

This is the opposite of the attribute's behavior. followTail = true explicitly ignores older, pre-existing events and only reads new content.

1. Splunk Enterprise Documentation, inputs.conf:

Location: inputs.conf specification file documentation, under the [monitor://] stanza details for the followTail attribute.

Content: "If you set this attribute to true, the Splunk platform starts indexing at the end of the file. It does not index any data that is in the file when you configure the input. It only indexes data that arrives after you configure the input." This directly supports the correct answer (D).

2. Splunk Enterprise Documentation, Getting Data In Manual:

Location: Chapter "Monitor files and directories with inputs.conf", section "Considerations for monitoring files and directories".

Content: The documentation states, "To start reading at the end of the file (to read only new data as it comes in), set followTail = true." This confirms that the purpose is to skip pre-existing content.