Splunk Core Consultant (SPLK-3003) Certification Sample Questions

02. A consultant is gathering information for a Splunk support case about an indexer behaving unexpectedly, and the customer's data is subject to strict handling rules. Which items does splunk diag collect from the instance it is run on?
(Choose two.)
a) The contents of the index directories on the instance
b) The configuration files that are in effect on the instance
c) The internal log files the instance has written
d) A sample of events drawn from each index

03. Events from a newly onboarded source all carry timestamps clustered within a few seconds of each other, matching the moment they were ingested rather than the times printed in the raw text. What is the cause?
a) The forwarder applied its own clock because the source type has no time zone defined for it.
b) Splunk could not locate a timestamp in the event and fell back to the time of indexing.
c) The source's timestamps lie outside the index's accepted time range, so they were replaced with the ingestion time.
d) Line breaking merged several source lines into one event, so only the final line's timestamp survived.

04. A consultant is documenting how configuration reaches the peers in a customer's indexer cluster. Which statements about the configuration bundle are correct?
(Choose two.)
a) A change made directly in a cluster-managed app on one peer is overwritten at the next push
b) It is distributed from the manager node and replaces the cluster-managed apps on every peer
c) It is distributed to the search heads as well, so that they share the peers' index definitions
d) It also configures the manager node, which applies the same apps to itself when it distributes them

05. Searches over one time range return an error naming a specific bucket, and the peer's logs report that the bucket's index files are corrupt. The raw data in that bucket is intact. What should the consultant do?
a) Take the affected bucket offline and restore it from the archive, since corrupted index files cannot be regenerated locally.
b) Reduce the index's retention so the affected bucket freezes early and the error stops occurring.
c) Delete the bucket and allow the cluster to replace it from another peer's copy during the next fixup cycle.
d) Rebuild the bucket so that its index files are regenerated from the raw data it still holds.

06. A customer's search head runs out of disk roughly once a week. The volume filling up holds search artifacts, and the largest contributors are scheduled reports with long retention on their results. What should the consultant address?
a) The search head's role quotas, since a role without a disk quota allows individual searches to consume the volume.
b) The index retention on the search head, since search results are written into a local index that has no size limit.
c) The lifetime of the saved searches' artifacts, since each run's results are retained for its configured period before being reaped.
d) The knowledge bundle replication settings, since a copy of each bundle is retained on the search head after every search.

07. In a customer's distributed deployment, the search heads and the deployment server keep their internal logs locally rather than forwarding them. Which reasons should the consultant give for changing this?
(Choose two.)
a) The logs stay available when the instance that produced them is the thing that has failed
b) Internal indexes on a non-indexing instance are otherwise excluded from license accounting
c) The Monitoring Console cannot assign a server role to an instance that keeps its internal logs locally
d) One search can cover the whole deployment instead of being repeated on each instance

08. After a two-hour network outage, a customer's universal forwarders have a large backlog. The consultant observes that each forwarder is sending at a steady rate well below what the network and indexers could absorb, and the backlog is clearing slowly. What explains this?
a) The forwarder is rotating across the available indexers on a fixed interval, and the switch pauses transmission each time.
b) The indexers are applying back pressure because their parsing queues are full, which throttles every connected forwarder equally.
c) The forwarder's default throughput limit is capping how fast it sends, and it applies to backlog and live data alike.
d) The forwarders are re-reading each monitored file from the beginning, so most of what they send is data already indexed.

09. Events from a monitored file are arriving with the forwarder's own host name, but each file is named after the device that produced it. Which approaches set the host value correctly from the file path?
(Choose two.)
a) Setting the host in the forwarder's output configuration so that it is applied as the data is sent
b) Setting a host regular expression on the monitor input, capturing the device name from the path
c) Setting the default host value on the monitor input to the device name
d) Setting a host segment on the monitor input, naming the path component that holds the device name

10. A misconfigured input has written a batch of events into the wrong index. The customer needs them removed from search results now rather than waiting for retention to age them out, and wants the ability tightly held. What should the consultant configure?
a) Grant a small team a role carrying the delete capability, which no role holds by default.
b) Shorten the retention period on the affected index until the events are frozen out of it.
c) Grant the team admin_all_objects, which lifts the object restrictions preventing the removal.
d) Apply a search filter to every role that excludes the affected events from results.