SPLK-1003 Exam Questions and Answers

QUESTION: 11

This file has been manually created on a universal forwarder:

/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:

/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog

Which file is now monitored?

/var/log/messages
/var/log/maillog
/var/log/maillog and /var/log/messages
none of the above

Answer(s): A

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Exampleaddaninputtoforwarders

Reveal Solution Next Question

QUESTION: 12

In which phase of the index time process does the license metering occur?

Input phase
Parsing phase
Indexing phase
Licensing phase

Answer(s): C

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/HowSplunklicensingworks

Reveal Solution Next Question

QUESTION: 13

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list –- debug. What will the output be?

A list of all the configurations on-disk that Splunk contains.
A verbose list of all configurations as they were when splunkd started.
A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
A list of the current running props.conf configurations along with a file path from which the configuration was made.

Answer(s): D

Reference:

https://answers.splunk.com/answers/494219/need-help-with-what-should-be-a-simple-precedence.html

Reveal Solution Next Question

QUESTION: 14

When running the command shown below, what is the default path in which deploymentserver.conf is created?
splunk set deploy-poll deployServer:port

SPLUNK_HOME/etc/deployment
SPLUNK_HOME/etc/system/local
SPLUNK_HOME/etc/system/default
SPLUNK_HOME/etc/apps/deployment

Answer(s): B

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Configuredeploymentclients

Reveal Solution Next Question

QUESTION: 15

The priority of layered Splunk configuration files depends on the file’s:

Owner
Weight
Context
Creation time

Answer(s): C

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Wheretofindtheconfigurationfiles

Reveal Solution Next Question

Splunk SPLK-1003 Exam (page: 3) Splunk Enterprise Certified Admin Updated on: 07-Feb-2026

QUESTION: 11

Reference:

QUESTION: 12

Reference:

QUESTION: 13

Reference:

QUESTION: 14

Reference:

QUESTION: 15

Reference:

Splunk SPLK-1003 Exam (page: 3)
Splunk Enterprise Certified Admin
Updated on: 07-Feb-2026