CertArea
All Splunk exams

Free Splunk Enterprise Certified Admin practice test: 30 questions with answers

30 original questions for Splunk Enterprise Certified Admin, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
56 questions, 60 min

Splunk Enterprise Certified Admin exam guide: topics, cost and format

All 30 Splunk Enterprise Certified Admin questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Getting Data In and Configuring Forwarders (4 questions)

  1. Question 1

    A company must send data from 300 Linux servers to indexers while keeping the footprint on each server small. The servers need no local parsing or filtering. Which forwarder type fits this requirement?

    1. ASearch head with a forwarding output group, which runs searches and forwards the results
    2. BHeavy Forwarder, which parses events on each server and needs more resources
    3. CUniversal Forwarder, which has a small footprint and performs only the input phase
    4. DDeployment server, which pushes data inputs down to clients and forwards events to indexers
    Show answer and explanation
    Correct answer: C

    The Universal Forwarder is the lightweight option that only collects and forwards data, which matches the requirement for a small footprint without parsing. The Heavy Forwarder parses events locally, and search heads and deployment servers do not forward raw data as their role.

  2. Question 2

    Which sequence correctly lists the three phases that Splunk uses when it processes incoming data?

    1. AParsing, input, indexing
    2. BInput, parsing, indexing
    3. CIndexing, parsing, input
    4. DInput, indexing, parsing
    Show answer and explanation
    Correct answer: B

    Data first passes through the input phase, then the parsing phase where events are broken and timestamped, and finally the indexing phase where the data is written to buckets. The other sequences place parsing or indexing before the data has been acquired and parsed.

  3. Question 3

    Which two activities take place during the parsing phase? (Choose two.)

    1. AIdentifying line breaks and splitting the incoming stream into individual events
    2. BExtracting timestamps from each event and assigning them to the event
    3. CWriting compressed raw data into journal.gz files inside a bucket
    4. DOpening monitored files and recording read positions in the fishbucket
    Show answer and explanation
    Correct answer: A, B

    Line breaking and timestamp extraction happen in the parsing phase, which is where events are formed. Writing journal files belongs to the indexing phase, and tracking file read positions belongs to the input phase.

  4. Question 4

    An administrator wants every event from a monitored directory to carry a specific host name instead of the forwarder's own host name. Which inputs.conf setting in the monitor stanza accomplishes this?

    1. AcrcSalt = <SOURCE> in the monitor stanza, which changes how file checksums are computed
    2. Bindex = <name> in the monitor stanza, which sets the destination index for those events
    3. Csourcetype = <name> in the monitor stanza, which sets the event format for those events
    4. Dhost = <name> in the monitor stanza, which sets the host field for those events
    Show answer and explanation
    Correct answer: D

    The host setting in the monitor stanza overrides the default host field for the events that the input collects. Index, sourcetype and crcSalt control destination, format and file change detection, so none of them changes the host name.

Splunk Admin Basics, License Management and Configuration Files (4 questions)

  1. Question 5

    An administrator runs btool on an indexer and sees a setting that is defined in both the default and local directories of the same app. Which rule decides the value that Splunk uses?

    1. AThe file with the most stanzas in it always wins, regardless of directory
    2. BThe value from the app that was installed most recently always wins
    3. CThe local directory overrides the default directory, and etc/system/local has the highest precedence
    4. DThe default directory always wins so that upgrades do not change behavior
    Show answer and explanation
    Correct answer: C

    Splunk layers configuration files so that a local copy overrides the same file in default, and system/local sits at the top of the precedence order. The other options invent rules based on file size, install date or upgrade safety, none of which Splunk uses.

  2. Question 6

    An administrator has one Enterprise license stack on the license manager and wants to reserve a portion of its daily indexing volume for a specific group of indexers. Which license construct does this?

    1. AA license slave, which splits the volume evenly across every forwarder in the deployment
    2. BA license stack, which assigns a share of the daily volume to one specific index only
    3. CA license group, which limits how many users can sign in to Splunk Web at once
    4. DA license pool, which assigns a share of a license stack's daily volume to selected indexers
    Show answer and explanation
    Correct answer: D

    Pools carve a stack's daily volume into allocations that are assigned to chosen license peers. A stack is the combined set of licenses of one type, not an allocation to an index, license groups select the active stack rather than users, and forwarders are not allotted volume.

  3. Question 7

    Which two statements about Splunk Enterprise licensing are correct? (Choose two.)

    1. AA Universal Forwarder must be covered by an Enterprise license key before it can send data
    2. BLicensed volume is measured by the amount of data that is indexed each day
    3. CEach user who runs searches on a search head must be assigned a separate license
    4. DData that a forwarder only passes through is metered when an indexer receives and indexes it
    Show answer and explanation
    Correct answer: B, D

    Enterprise licensing meters indexed volume, and forwarding-only data is counted when it is indexed, not when it passes through a forwarder. A Universal Forwarder does not need a license key, and Enterprise licensing does not charge per search user.

  4. Question 8

    An administrator needs to find out which file supplies each effective setting in inputs.conf on a universal forwarder. Which command shows the source file for every setting?

    1. Asplunk show config inputs --verbose
    2. Bsplunk btool inputs list
    3. Csplunk reload deploy-server
    4. Dsplunk btool inputs list --debug
    Show answer and explanation
    Correct answer: D

    Adding --debug to btool list prints the file path that each effective setting comes from, which is what the administrator needs. Running btool without --debug shows the merged values but not their source, and the reload and show commands do not report file origins.

Monitor, Network, Scripted and Agentless Inputs (4 questions)

  1. Question 9

    A team must receive syslog from network devices and wants to reduce the chance that events are silently lost in transit. Which input type should they configure?

    1. AA TCP input, because the protocol retransmits lost packets and so events are less likely to vanish
    2. BA UDP input, because the protocol guarantees that every packet reaches the indexer in order
    3. CA file monitor input, because the devices can be set to write their syslog to local files
    4. DA scripted input, because it polls each network device on a fixed schedule to collect logs
    Show answer and explanation
    Correct answer: A

    TCP provides reliable, ordered delivery with retransmission, which lowers the risk of dropped events compared with UDP. UDP does not guarantee delivery, and file monitor and scripted inputs are not the right choices for live syslog streams.

  2. Question 10

    Which stanza type in inputs.conf runs a command at a set interval and indexes the output it produces as events?

    1. A[monitor://] stanza, which watches files and directories for new content
    2. B[script://] stanza, which runs a command at an interval and indexes its output
    3. C[tcp://] stanza, which listens on a port for raw data sent by remote hosts
    4. D[http://] stanza, which defines a token for accepting events over HTTP
    Show answer and explanation
    Correct answer: B

    The script:// stanza is the scripted input, which runs a command on an interval and indexes what it prints. The monitor, tcp and http stanzas handle files, network streams and HTTP event collection respectively.

  3. Question 11

    A developer wants an application to send events to Splunk over HTTP using a token, instead of writing log files that a forwarder reads. Which input type fits this requirement?

    1. AHTTP Event Collector, which accepts events sent over HTTP or HTTPS that carry a token
    2. BA monitor input on the application's log directory, which reads whatever the application writes
    3. CA UDP input on a network port, which receives datagrams from the application without any authentication or confirmation that each event was delivered
    4. DA WMI input, which collects events from remote Windows hosts without needing a token
    Show answer and explanation
    Correct answer: A

    The HTTP Event Collector accepts events posted over HTTP or HTTPS and authenticates each request with a token, which matches the requirement. Monitor, UDP and WMI inputs do not accept HTTP posts with tokens, and WMI only collects Windows data.

  4. Question 12

    An administrator needs to collect Windows event log data from remote Windows servers without installing a forwarder on each of them. Which input type is designed for this?

    1. AAn HTTP Event Collector input, which requires each remote server to hold a separate token
    2. BA TCP input on a Linux forwarder, which reads the remote servers' local log files over SSH from a central collection host that polls each one
    3. CA WMI input on a Windows forwarder, which collects Windows event and performance data from remote hosts
    4. DA monitor input on a UNC path, which lists only the local host's event logs
    Show answer and explanation
    Correct answer: C

    WMI inputs run on a Windows host and use Windows Management Instrumentation to collect event and performance data from remote machines. A Linux TCP input does not read remote logs over SSH, HEC does not collect Windows logs by itself, and a monitor input on a UNC path reads files rather than event logs.

Fine Tuning Inputs, Parsing and Manipulating Raw Data (4 questions)

  1. Question 13

    An administrator wants events from one sourcetype routed to a separate index based on their content. The change must happen where parsing occurs, on an indexer or heavy forwarder. Which pair of configuration files and settings accomplishes this?

    1. Aprops.conf references a transform, and transforms.conf sets DEST_KEY to _MetaData:Index with a matching REGEX
    2. Bindexes.conf defines the new index, and inputs.conf renames the sourcetype so the events move
    3. Cserver.conf sets the routing rule, and outputs.conf defines a tcpout group for the new index
    4. Dlimits.conf sets the index size, and savedsearches.conf runs a scheduled search to copy events
    Show answer and explanation
    Correct answer: A

    Index routing is done in parsing by pointing a props.conf stanza at a transform in transforms.conf, where DEST_KEY set to _MetaData:Index picks the destination. Universal forwarders do not parse, and the other pairs do not route events at index time.

  2. Question 14

    A log source includes card numbers that must not be stored in the index. The administrator wants matching text replaced before the events are written. Which props.conf setting performs this substitution?

    1. ASEDCMD-<class> with an s/regex/replacement/g expression, applied at index time
    2. BTIME_FORMAT with a strptime pattern, which tells Splunk how to read timestamps
    3. CLINE_BREAKER with a regex, which tells Splunk where each event begins and ends
    4. DMAX_EVENTS with a number, which limits how many lines are read for one event
    Show answer and explanation
    Correct answer: A

    SEDCMD applies a sed-style substitution to the raw event at index time, which is how the card numbers can be masked before storage. TIME_FORMAT, LINE_BREAKER and MAX_EVENTS control timestamp reading and event boundaries rather than replacing text.

  3. Question 15

    Multi-line application events are being split into one event per line. Which props.conf setting defines the regular expression that marks where each event starts and ends?

    1. AKV_MODE, which controls whether key-value pairs are extracted at search time
    2. BTRANSFORMS, a list of transform stanzas applied to each event after it is broken
    3. CLINE_BREAKER, a regex that marks the boundaries between events in the incoming stream
    4. DTZ, which sets the time zone that Splunk uses when it reads event timestamps
    Show answer and explanation
    Correct answer: C

    LINE_BREAKER is the props.conf setting that uses a capture group regex to split the stream into events, which fixes the one-line-per-event problem when configured correctly. TRANSFORMS, KV_MODE and TZ do different jobs and do not define event boundaries.

  4. Question 16

    Timestamps in events from a remote office are parsed in the wrong time zone because the events do not include a zone. Which setting tells Splunk which time zone to apply when it extracts timestamps?

    1. ATZ in props.conf, which sets the time zone used when timestamps are parsed
    2. BTIME_FORMAT in indexes.conf, which sets the time zone for each index's buckets
    3. CTZ in inputs.conf, which changes the time zone of the forwarder's own clock
    4. DDATETIME_CONFIG in server.conf, which controls the time zone of the search head
    Show answer and explanation
    Correct answer: A

    The TZ setting in props.conf tells the parsing phase which time zone to use for timestamps that lack one. TIME_FORMAT belongs in props.conf and does not set zones, and the inputs.conf and server.conf options do not control timestamp parsing for events.

Splunk Indexes (4 questions)

  1. Question 17

    An engineer reviews an index's bucket directory and sees a bucket that is open for writes and receives every new incoming event. Which bucket type is this?

    1. ACold bucket, which is moved to slower storage for long-term retention
    2. BWarm bucket, which holds older data that is no longer written to
    3. CHot bucket, which is open for writes and holds the newest events
    4. DThawed bucket, which contains archived data that has been restored for searching
    Show answer and explanation
    Correct answer: C

    New events are written to hot buckets, which are the only buckets open for writes. Warm and cold buckets hold data that has already rolled out of the hot state, and thawed buckets hold restored archived data, so none of them receive new incoming events.

  2. Question 18

    A compliance team wants events in an index to age out after a fixed retention period and be removed unless they were archived first. Which indexes.conf setting controls the age at which data is frozen?

    1. AmaxDataSize, which sets the size each bucket can grow to before it rolls
    2. BmaxHotSpanSecs, which sets how long a hot bucket can span time
    3. CfrozenTimePeriodInSecs, which sets how old data can be before it is frozen
    4. DrepFactor, which sets how many copies of each bucket the cluster keeps
    Show answer and explanation
    Correct answer: C

    The frozenTimePeriodInSecs setting controls when data is considered old enough to be frozen, and frozen data is removed unless it is archived through a cold-to-frozen path. The other settings control bucket size, bucket time span and replication, not retention age.

  3. Question 19

    An administrator resets the fishbucket checkpoint for a monitored file, and afterward the file's existing contents are indexed again from the beginning. Which component stored the checkpoint that was cleared?

    1. AThe fishbucket, which stores read checkpoints for monitored files
    2. BThe tsidx files, which store the keyword index for each bucket
    3. CThe journal.gz file, which stores the compressed raw event data
    4. DThe indexes.conf file, which stores index paths and retention settings
    Show answer and explanation
    Correct answer: A

    The fishbucket records how far each monitored file has been read, so clearing an entry makes Splunk treat the file as new. The tsidx and journal files belong to bucket storage, and indexes.conf holds configuration rather than read positions.

  4. Question 20

    A compliance auditor asks whether indexed bucket contents have been altered on disk. The administrator needs Splunk to write hashes so that integrity can be checked later. Which indexes.conf setting enables this?

    1. AfrozenTimePeriodInSecs, which controls the age at which buckets move to the frozen state
    2. BrepFactor, which sets how many copies of each bucket are kept across the peers in a cluster
    3. ChomePath, which sets the directory where hot and warm buckets are written on the indexer
    4. DenableDataIntegrityControl, which causes Splunk to compute hashes for buckets as they are written
    Show answer and explanation
    Correct answer: D

    The enableDataIntegrityControl setting turns on hash generation so that bucket data can be verified later. The other settings control retention, replication and storage location, not integrity checking.

User Management and Authentication (4 questions)

  1. Question 21

    A security team needs a role for junior analysts who may search only the web and firewall indexes and must not change knowledge objects or other shared configuration. Which approach best meets this requirement?

    1. AGrant the admin_all_objects capability to a new role so that analysts can see every index in the environment and still be unable to change anything else
    2. BAssign the admin role to each analyst and then remove all of the edit capabilities from the admin role for everyone
    3. CAssign the power role and then edit the index list on the search app so that only the two indexes appear
    4. DCreate a custom role that inherits from the user role, then set srchIndexesAllowed in its stanza to the web and firewall indexes
    Show answer and explanation
    Correct answer: D

    A custom role that inherits from the user role and sets srchIndexesAllowed limits search to the named indexes while keeping edit rights restricted. Assigning admin or power and editing app lists does not enforce index-level access, and admin_all_objects gives broad rights that the requirement excludes.

  2. Question 22

    Which two actions are part of configuring LDAP authentication in Splunk Enterprise? (Choose two.)

    1. ADefine an LDAP strategy in authentication.conf and set the connection details for the LDAP server
    2. BMap LDAP groups to Splunk roles so that users receive the right capabilities at login
    3. CStore each LDAP user's password in the local passwd file on every search head
    4. DRestart the deployment server so that it pushes the role mappings to every search peer
    Show answer and explanation
    Correct answer: A, B

    LDAP is configured with an LDAP strategy in authentication.conf and by mapping directory groups to Splunk roles. Storing passwords locally defeats the purpose of LDAP, and the deployment server does not distribute authentication settings to search peers.

  3. Question 23

    An organization requires a second factor for everyone who signs in to Splunk Web. Splunk is configured for SAML single sign-on, and the identity provider handles user authentication. Which statement describes how the second factor is enforced?

    1. AEach analyst must install a browser extension that generates one-time codes for Splunk Web
    2. BThe identity provider can enforce the second factor when it authenticates users who sign in through SAML
    3. CThe second factor is set on each user's role so that only users with admin roles are prompted
    4. DSecond-factor checks apply only to searches that run against the summary index
    Show answer and explanation
    Correct answer: B

    With SAML, the identity provider performs authentication, so it can require a second factor before issuing the assertion that Splunk accepts. Browser extensions, role settings and summary index searches are not how Splunk enforces a second factor for sign-in.

  4. Question 24

    A service account needs a local Splunk user with the user role, created from the command line on a Splunk Enterprise instance. Which command should the administrator run?

    1. Asplunk add user with a password and the -role flag naming the role for the account
    2. Bsplunk edit user with the -role flag, which modifies an account that already exists
    3. Csplunk create account in the authentication.conf stanza, which adds a local user
    4. Dsplunk btool users add with the -role flag, which writes the account to users.conf
    Show answer and explanation
    Correct answer: A

    The splunk add user command creates a new local account, and the -role flag assigns it a role. The edit command changes an existing account, and authentication.conf and btool are not used to create users, so those options are wrong.

Distributed Search (3 questions)

  1. Question 25

    An administrator adds an indexer to a search head as a distributed search peer. When a user runs a search on the search head, results come back from that indexer. What role does the indexer play?

    1. ASearch head, which distributes events to forwarders and manages their configuration
    2. BSearch peer, which receives search requests from the search head and returns matching results
    3. CDeployment server, which pushes apps to clients and reports their installed inventory
    4. DLicense manager, which tracks daily volume and grants search permissions to users
    Show answer and explanation
    Correct answer: B

    An indexer that is configured as a distributed search peer receives search requests from the search head and returns the results. The other roles are a search head, a deployment server and a license manager, and none of them returns search results for a search head.

  2. Question 26

    A search head cluster is being scaled because many users run concurrent searches and the single search head is saturated. Which scaling option adds search heads that share configuration and knowledge objects?

    1. AA second standalone search head that uses the same local passwd file and nothing else
    2. BSearch head clustering, with a deployer that distributes apps and configuration to the members
    3. CConverting the existing search head into a heavy forwarder so that searches run on the forwarder
    4. DPointing all users at the same indexer's Splunk Web port so that searches share its resources
    Show answer and explanation
    Correct answer: B

    Search head clustering adds members that share knowledge objects and configuration, and the deployer distributes apps to them. A standalone search head does not share configuration, converting to a heavy forwarder removes the search role, and pointing users at an indexer does not scale search.

  3. Question 27

    A search head must send searches only to a defined set of indexers that serve one business unit, rather than to every peer it knows about. Which configuration groups those search peers so they can be targeted together?

    1. AA distributed search group in distsearch.conf that lists the chosen search peers
    2. BA server class in serverclass.conf that lists the forwarders assigned to the group
    3. CAn index cluster definition in indexes.conf that lists the buckets to replicate
    4. DA forwarder output group in outputs.conf that lists the indexers for forwarded data
    Show answer and explanation
    Correct answer: A

    Distributed search groups in distsearch.conf let a search head target a named subset of search peers. Server classes select deployment clients, index clusters control replication, and forwarder output groups define where forwarded data goes, so none of them scopes searches.

Forwarder Management (3 questions)

  1. Question 28

    An administrator wants one set of forwarders in a data center to receive a deployment app while other forwarders do not. Which mechanism on the deployment server achieves this?

    1. ACopy the app by hand into the etc/apps directory of every forwarder in that data center, then restart each forwarder so that it loads the app manually
    2. BDefine a server class in serverclass.conf with whitelist and blacklist filters, then map the deployment app to that server class
    3. CSet a license group on each forwarder so that the deployment server can filter them
    4. DCreate a search head cluster so that the deployer sends the app to the forwarders
    Show answer and explanation
    Correct answer: B

    Server classes in serverclass.conf use filters to select which clients receive which deployment apps. Hand-copying apps does not use the deployment server, license groups do not control app delivery, and a deployer distributes apps to search head cluster members, not forwarders.

  2. Question 29

    An administrator reviews a forwarder that does not appear to fetch its deployment apps. Which setting in deploymentclient.conf tells the client which deployment server to poll?

    1. AThe internal index setting, which sends the client's own internal logs to a chosen index
    2. BThe license pool setting, which assigns the client to a licensing group on the license manager
    3. CThe cluster manager setting, which points the client at the cluster that owns its buckets
    4. DThe targetUri setting, which gives the address of the deployment server the client polls
    Show answer and explanation
    Correct answer: D

    The targetUri setting in deploymentclient.conf identifies the deployment server that the client contacts for its apps. License pools, cluster managers and internal index routing are configured elsewhere and do not control which deployment server a client polls.

  3. Question 30

    An administrator is preparing a new app for forwarders that are managed by a deployment server. In which directory on the deployment server should the app package be placed so that it can be deployed to clients?

    1. A$SPLUNK_HOME/etc/apps, where the deployment server's own apps are stored
    2. B$SPLUNK_HOME/etc/deployment-apps, where apps are staged for deployment to clients
    3. C$SPLUNK_HOME/etc/shcluster/apps, where the search head cluster deployer keeps its apps
    4. D$SPLUNK_HOME/etc/system/local, where instance-wide settings are kept
    Show answer and explanation
    Correct answer: B

    Apps for deployment clients are staged under etc/deployment-apps on the deployment server, and server classes then map them to clients. The apps directory holds the server's own apps, system/local holds instance settings and shcluster/apps belongs to a search head cluster deployer.