Splunk Cloud Admin (SPLK-1005) Certification Sample Questions

01. Analysts filter constantly on a transaction ID in a high-volume payment log collected by a heavy forwarder, and after weighing the trade-offs the team has decided to make it an index-time field named txn_id. Events contain text such as txn=9F21C7, and props.conf for the sourcetype already carries TRANSFORMS-txn = txn_indexed.
Which [txn_indexed] stanza in transforms.conf creates the indexed field?
a) REGEX = txn=(\w+), FORMAT = txn_id::$1 and DEST_KEY = _raw
b) REGEX = txn=(\w+), FORMAT = $1 and DEST_KEY = MetaData:txn_id
c) REGEX = txn=(?<txn_id>\w+) with no further lines
d) REGEX = txn=(\w+), FORMAT = txn_id::$1 and WRITE_META = true

02. A noisy input running on a set of forwarders has to be stopped for the duration of a maintenance window and brought back afterwards. The stanza was delivered by a deployment app, so deleting it locally would simply be undone the next time the app is pushed. What is the appropriate change?
a) Add the input's path to the forwarder's exclusion list, and remove it again later.
b) Rename the stanza so that it no longer matches any path, then rename it back afterwards.
c) Set disabled = 1 on the stanza in the app, and set it back afterwards.
d) Stop the forwarder service on each of the hosts until the maintenance window has passed.

03. Universal forwarders in the customer's data center send a multi-line application log to a Splunk Cloud tenant that load-balances across many indexers, and some events arrive torn in two. The administrator sets EVENT_BREAKER_ENABLE = true and an EVENT_BREAKER pattern for the sourcetype in props.conf on the forwarders.
Which two statements describe the effect of this change?
(Choose two.)
a) The forwarders switch between receiving indexers only at an event boundary, not part of the way through an event
b) Where events break in the index is still decided by LINE_BREAKER on the instance that parses, here the tenant
c) The forwarders now parse the events and assign timestamps, so the tenant's rules for this sourcetype stop applying
d) EVENT_BREAKER replaces LINE_BREAKER for this sourcetype, so the tenant-side line-breaking rule can be removed

04. An administrator uploads a sample of a new appliance log through Add Data in the Splunk Cloud tenant and adjusts event breaks and timestamp settings on the Set Source Type step until the preview shows correct events. Production data will come from universal forwarders that monitor the same log on the collection hosts.
What makes the production data use the settings that were tested?
a) Index the sample into the production index so that Splunk learns the format for later data
b) Nothing further; the preview's settings already apply to future data from that path
c) Save the settings as a named sourcetype, then set that sourcetype on the forwarders' monitor inputs
d) Copy the tested attributes into inputs.conf on the forwarders, where each monitor stanza can carry them

05. Universal forwarders read CSV drops from an order system and send them straight to Splunk Cloud. The sourcetype is defined on the forwarders with INDEXED_EXTRACTIONS = csv, and the fields arrive correctly. To drop test orders, the administrator installs an app on the Cloud stack whose props.conf stanza for that sourcetype references a nullQueue transform whose regex matches the test-order rows. Test orders are still indexed.
What is the most likely reason?
a) Structured parsing ran on the forwarders, so the indexers never parse these rows or apply their transforms
b) A nullQueue transform applies only to monitor inputs, not to files read as CSV
c) The transform's regex runs against the extracted fields, so it must name the order_type field and not the row text
d) Apps installed on the Cloud stack take effect only for data received through HTTP Event Collector

06. A universal forwarder finished reading /data/exports/orders.csv last week through a single-file monitor stanza, but the events were sent to the wrong index. The stanza's index has since been corrected, and the team now wants the whole file read and indexed again. The file itself has not changed.
Which actions cause the forwarder to read the file again from the beginning?
(Choose two.)
a) Change the sourcetype on the stanza as well as the index
b) Add a crcSalt value to the stanza for the file
c) Reset the file's checkpoint record in the forwarder's fishbucket
d) Restart the forwarder so the corrected stanza is loaded

07. Twelve Linux servers send syslog over TCP to a heavy forwarder under the shared sourcetype linux:syslog. Only the three staging servers, stage-web01 to stage-web03, emit a cron message that should be dropped; the same message from production servers must be kept. The host is set from the connection and does not appear in the message text. A nullQueue transform matching the cron message already exists.
Where should the TRANSFORMS- reference to it be placed?
a) In a [host::stage-web0*] stanza in props.conf
b) In the TCP input's stanza in the forwarder's inputs.conf
c) In a [source::stage-web0*] stanza in props.conf
d) In the [linux:syslog] stanza in props.conf

08. A monitor input is being added on a forwarder for an application log file that already contains several months of history. The team wants only the lines written from the moment monitoring begins, so the stanza is created with followTail = 1. What effect does that setting have on how the file is read?
a) The monitor pauses whenever the downstream queue fills, and resumes reading once the queue drains again.
b) New lines are indexed first, and the file's earlier content is then backfilled in a second pass.
c) Only a read-position checkpoint is recorded for the file; no events are indexed until the checkpoint is cleared.
d) The content already in the file is skipped, and indexing starts from data appended after the input begins monitoring.

09. Forty network devices can send syslog only over UDP, and their data must reach a Splunk Cloud tenant. The team compares two designs inside the customer's own network. In design 1 the devices send straight to a UDP input on a universal forwarder. In design 2 they send to a dedicated syslog server that writes each device's messages to files, and a universal forwarder on that server monitors those files.
Which two advantages does design 2 have over design 1?
(Choose two.)
a) The devices receive delivery confirmation, so datagrams lost on the way to the syslog server are sent again.
b) Messages keep being received and written to disk while the forwarder is restarted or its queues are blocked.
c) The universal forwarder parses the files before sending, so line breaking no longer depends on the tenant.
d) A copy of what was received stays on the server's disk, so data can be ingested again if a problem is found downstream.

10. A heavy forwarder in the customer's data center runs a vendor add-on that collects firewall logs, masks a field with index-time rules and sends the result to the Splunk Cloud tenant. It does not index anything locally. The destination indexes already exist in the tenant, and search-time field extractions for the firewall data are installed there.
Which two sets of configuration must be present on the heavy forwarder itself?
(Choose two.)
a) An indexes.conf defining each destination index, so the events have an index to be routed to
b) The search-time field extractions, so events leave with their fields already defined
c) The props.conf and transforms.conf rules that mask the field during parsing
d) The tenant's forwarder credentials package, supplying the destination and the certificates