Free SPLK-1003 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

A bucket is the object that stores events inside of an index. According to the Splunk documentation1,

“An index is a collection of directories, also called buckets, that contain index files. Each bucket

represents a specific time range.” A bucket can be in one of several states, such as hot, warm, cold,

frozen, or thawed1. Buckets are managed by indexers or clusters of indexers1.

Splunk checks role-to-group mapping only during user login for external authentication (e.g., LDAP,

SAML). Users already logged in will continue using their previously assigned roles until they log out

and log back in.

The changes to role mapping do not disrupt ongoing sessions.

Incorrect Options:

B: Search is not disabled upon role updates.

C: This is incorrect since existing users are also updated upon the next login.

D: Role updates do not terminate ongoing sessions.

Splunk Docs: Configure user authentication

https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking Attribute : SHOULD_LINEMERGE = [true|false] Description : When set to true, the Splunk platform combines several input lines into a single event, with configuration based on the settings described in the next section.

Users log on to the search head and run reports: – The search head dispatches searches to the peers

– Peers run searches in parallel and return their portion of results – The search head consolidates the

individual results and prepares reports

According to the Splunk documentation1, event processing occurs at the parsing phase of the data

pipeline. The parsing phase is where Splunk software processes incoming data into individual events,

extracts timestamp information, assigns source types, and performs other tasks to make the data

searchable1. The parsing phase can also apply field extractions, event type matching, and other

transformations to the events2.

This is explained in the Splunk documentation1, which states:

If an indexer goes down during a search, the search head notifies you that the results might be

incomplete. The search head does not attempt to re-run the search on another indexer.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Typesofforwarders

"A heavy forwarder parses data before forwarding it and can route data based on criteria such as

source or type of event."

https://docs.splunk.com/Documentation/Splunk/8.0.5/Updating/Updateconfigurations First line

says it all: "The deployment server distributes deployment apps to clients."

curl “https://mysplunkserver.example.com:8088/services/collector” \ -H “Authorization: Splunk

DF4S7ZE4-3GS1-8SFS-E777-0284GG91PF67” \ -d ‘{“event”: “Hello World”}, {“event”: “Hola Mundo”},

{“event”: “Hallo Welt”}’. This is the correct curl command to send multiple events through HTTP

Event Collector (HEC), which is a token-based API that allows you to send data to Splunk Enterprise

from any application that can make an HTTP request. The command has the following components:

The URL of the HEC endpoint, which consists of the protocol (https), the hostname or IP address of

the Splunk server (mysplunkserver.example.com), the port number (8088), and the service name

(services/collector).

The header that contains the authorization token, which is a unique identifier that grants access to

the HEC endpoint. The token is prefixed with Splunk and enclosed in quotation marks. The token

value (DF4S7ZE4-3GS1-8SFS-E777-0284GG91PF67) is an example and should be replaced with your

own token value.

The data payload that contains the events to be sent, which are JSON objects enclosed in curly braces

and separated by commas. Each event object has a mandatory field called event, which contains the

raw data to be indexed. The event value can be a string, a number, a boolean, an array, or another

JSON object. In this case, the event values are strings that say hello in different languages.

Immediately after installation, a universal forwarder will start generating internal Splunk logs that

contain information about its own operation, such as configuration changes, data inputs, and

forwarding activities1. These logs are stored in the $SPLUNK_HOME/var/log/splunk directory on the

universal forwarder machine1. The universal forwarder will not automatically detect any indexers in

its subnet and begin routing data, as it needs to be configured with the IP address and port number

of the indexer or the deployment server2. The universal forwarder will not begin reading local files

on its server, as it needs to be configured with the data inputs that specify which files or directories

to monitor2. The universal forwarder will not send an email to the operator that the installation

process has completed, as this is not a default behavior of the universal forwarder and would require

additional configuration3.

When using a directory monitor input, specific source types can be selectively overridden using the

props.conf file. According to the Splunk documentation1, “You can specify a source type for data

based on its input and source. Specify source type for an input. You can assign the source type for

data coming from a specific input, such as /var/log/. If you use Splunk Cloud Platform, use Splunk

Web to define source types. If you use Splunk Enterprise, define source types in Splunk Web or by

editing the inputs.conf configuration file.” However, this method is not very granular and assigns the

same source type to all data from an input. To override the source type on a per-event basis, you

need to use the props.conf file and the transforms.conf file2. The props.conf file contains settings

that determine how the Splunk platform processes incoming data, such as how to segment events,

extract fields, and assign source types2. The transforms.conf file contains settings that modify or

filter event data during indexing or search time2. You can use these files to create rules that match

specific patterns in the event data and assign different source types accordingly2. For example, you

can create a rule that assigns a source type of apache_error to any event that contains the word

“error” in the first line2.

The inputs.conf file is used to configure inputs, distributed inputs such as forwarders, and file system

monitoring in Splunk1.

The [script://myscript.sh] stanza specifies a script input, which means that Splunk runs the script and

indexes its output1.

The interval setting determines how often Splunk runs the script. If the interval is set to 0, the script

runs only once when Splunk starts up1. If the interval is omitted, the script runs at the default

interval of 60 seconds2.

Therefore, option C is correct, and the other options are incorrect.

The answer to your question is C. services/data/collector. This is the endpoint URI used to collect

data in a customer managed Splunk Enterprise environment. According to the Splunk

documentation1, “The HTTP Event Collector REST API endpoint is /services/data/collector. You can

use this endpoint to send events to HTTP Event Collector on a Splunk Enterprise or Splunk Cloud

Platform deployment.” You can also use this endpoint to send events to a specific token or index1.

For example, you can use the following curl command to send an event with the token 578254cc-

05f5-46b5-957b-910d1400341a and the index main:

curl -k https://localhost:8088/services/data/collector -H 'Authorization: Splunk 578254cc-05f5-46b5-

957b-910d1400341a' -d '{"index":"main","event":"Hello, world!"}'

https://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdat

a#Include_or_exclude_specific_incoming_data

https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Perform_se

lective_indexing_and_forwarding

Specifies a comma-separated list of tcpout group names. Use this setting to selectively forward your

data to specific indexers by specifying the tcpout groups that the forwarder should use when

forwarding the data. Define the tcpout group names in the outputs.conf file in

[tcpout:] stanzas. The groups present in defaultGroup in [tcpout] stanza in the

outputs.conf file.

The correct answer is D. Place both props . conf and transforms . conf on the Heavy Forwarder for

source A, and place both props . conf and transforms . conf on the indexer for source B.

According to the Splunk documentation1, to mask sensitive data from raw events, you need to use

the SEDCMD attribute in the props.conf file and the REGEX attribute in the transforms.conf file. The

SEDCMD attribute applies a sed expression to the raw data before indexing, while the REGEX

attribute defines a regular expression to match the data to be masked. You need to place these files

on the Splunk instance that parses the data, which is usually the indexer or the heavy forwarder2.

The universal forwarder does not parse the data, so it does not need these files.

For source A, the data is routed through a heavy forwarder, which can parse the data before sending

it to the indexer. Therefore, you need to place both props.conf and transforms.conf on the heavy

forwarder for source A, so that the masking takes place before indexing.

For source B, the data is routed directly to the indexer, which parses and indexes the data. Therefore,

you need to place both props.conf and transforms.conf on the indexer for source B, so that the

masking takes place before indexing.

1: Redact data from events - Splunk Documentation 2: Where do I configure my Splunk

settings? - Splunk Documentation

https://docs.splunk.com/Documentation/Splunk/8.0.1/Troubleshooting/Usebtooltotroubleshootcon

figurations

"The btool command simulates the merging process using the on-disk conf files and creates a report

showing the merged settings."

"The report does not necessarily represent what's loaded in memory. If a conf file change is made

that requires a service restart, the btool report shows the change even though that change isn't

active."

The correct answer is C. MonitorNoHandle.

MonitorNoHandle is a type of input stanza that allows a Splunk forwarder to read files on Windows

systems as Windows writes to them. It does this by using a kernel-mode filter driver to capture raw

data as it gets written to the file1. This input stanza is useful for files that get locked open for writing,

such as the Windows DNS server log file2.

The other options are incorrect because:

A . Tail Reader is not a valid input stanza in Splunk. It is a component of the Tailing Processor, which is

responsible for monitoring files and directories for new data3.

B . Upload is a type of input stanza that allows Splunk to index a single file from a local or network file

system. It is not suitable for files that are constantly being updated, as it only indexes the file once

and does not monitor it for changes4.

D . Monitor is a type of input stanza that allows Splunk to monitor files and directories for new data.

However, it may not work for files that Windows prevents Splunk from reading while they are open.

In such cases, MonitorNoHandle is a better option2.

Reference

A Splunk forwarder is a lightweight agent that can forward data to a Splunk deployment. There are

two types of forwarders: universal and heavy. A universal forwarder can only forward data, while a

heavy forwarder can also perform parsing, filtering, routing, and aggregation on the data before

forwarding it5.

An input stanza is a section in the inputs.conf configuration file that defines the settings for a specific

type of input, such as files, directories, network ports, scripts, or Windows event logs. An input

stanza starts with a square bracket, followed by the input type and the input path or name. For

example, [monitor:///var/log] is an input stanza for monitoring the /var/log directory.

1: Monitor files and directories - Splunk Documentation

2: How to configure props.conf for proper line breaking … - Splunk Community

3: How Splunk Enterprise monitors files and directories - Splunk Documentation

4: Upload a file - Splunk Documentation

5: Use forwarders to get data into Splunk Enterprise - Splunk Documentation

[6]: inputs.conf - Splunk Documentation

https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Howuserscancontroldistributedse

arches

"From the user standpoint, specifying and running a distributed search is essentially the same as

running any other search. Behind the scenes, the search head distributes the query to its search

peers, and consolidates the results when presenting them to the user."

https://docs.splunk.com/Documentation/Splunk/latest/Deploy/Datapipeline "The data pipeline

segments in depth. INPUT - In the input segment, Splunk software consumes data. It acquires the

raw data stream from its source, breaks it into 64K blocks, and annotates each block with some

metadata keys. The keys can also include values that are used internally, such as the character

encoding of the data stream, and values that control later processing of the data, such as the index

into which the events should be stored. PARSING Annotating individual events with metadata copied

from the source-wide keys. Transforming event data and metadata according to regex transform

rules."