A company is ingesting logs from a custom application that writes multi-line events. The admin has configured LINE_BREAKER in props.conf to merge the lines, but the events are still being split. What is the most likely cause?

The LINE_BREAKER regex is not matching the event boundaries correctly.

The sourcetype is not defined in props.conf.

The indexer is not restarting after the configuration change.

The TZ attribute is set incorrectly.

During parsing, which default metadata fields does Splunk automatically extract from raw data?

timestamp, severity, and message

An admin is ingesting firewall logs that contain timestamps in the format '2024-05-01 13:45:22' with no time zone information. The firewall is in a different time zone than the Splunk Cloud instance. The admin wants the events to be indexed with the correct time. What should the admin do?

Change the firewall to log timestamps in UTC.

Use a search-time extraction to convert the timestamp.

Set the TZ attribute in props.conf for the firewall's sourcetype to the firewall's time zone.

Set the TIME_FORMAT in props.conf to include the time zone offset.

A company is migrating from on-premises Splunk to Splunk Cloud. They have a custom props.conf that includes a TIME_FORMAT for a specific sourcetype. After migration, the admin notices that events are indexed with the current time instead of the timestamp in the event. What is the most likely cause?

The TZ attribute is missing from props.conf.

The custom props.conf was not migrated to Splunk Cloud.

The sourcetype is not defined in Splunk Cloud.

The indexer's clock is incorrect.

A Splunk admin is ingesting application logs from multiple servers. The logs do not contain a hostname, but the admin wants to ensure that each event is associated with the correct server. The logs are sent via a universal forwarder. What is the default behavior for host assignment?

Splunk uses the hostname of the universal forwarder as the default host value.

Splunk uses the IP address of the source server as the default host value.

Splunk uses the sourcetype as the host value.

Splunk leaves the host field empty, and the admin must set it manually.

SplunkCloud Certified Admin

Domain 9Objective 1

Describe the Default Processing That Occurs During the Input Phase CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Part of the Fine-tuning Inputs domain, which accounts for 5% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–3 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

4concepts

5%of the exam

Questions 1–5

1expert · hard
A company is ingesting logs from a custom application that writes multi-line events. The admin has configured LINE_BREAKER in props.conf to merge the lines, but the events are still being split. What is the most likely cause?
Select an answer first
2foundation · easy
During parsing, which default metadata fields does Splunk automatically extract from raw data?
Select an answer first
3application · medium
An admin is ingesting firewall logs that contain timestamps in the format '2024-05-01 13:45:22' with no time zone information. The firewall is in a different time zone than the Splunk Cloud instance. The admin wants the events to be indexed with the correct time. What should the admin do?
Select an answer first
4expert · hard
A company is migrating from on-premises Splunk to Splunk Cloud. They have a custom props.conf that includes a TIME_FORMAT for a specific sourcetype. After migration, the admin notices that events are indexed with the current time instead of the timestamp in the event. What is the most likely cause?
Select an answer first
5application · medium
A Splunk admin is ingesting application logs from multiple servers. The logs do not contain a hostname, but the admin wants to ensure that each event is associated with the correct server. The logs are sent via a universal forwarder. What is the default behavior for host assignment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.