A Splunk admin is configuring a sourcetype for logs from a device that sends timestamps in UTC. However, due to a network issue, the events are sometimes delayed by several hours. The admin wants to ensure that searches for 'last 15 minutes' correctly include events that were generated in the last 15 minutes, even if they were indexed later. What is the most important configuration to achieve this?

Set the TIME_FORMAT in props.conf to '%Y-%m-%d %H:%M:%S'.

Set the MAX_TIMESTAMP_LOOKAHEAD in props.conf to a high value.

Use the `_index_earnest` setting in props.conf to force Splunk to index events immediately.

Set the TZ attribute in props.conf to 'UTC'.

An admin is ingesting logs from two different devices. Device A sends timestamps in UTC, and Device B sends timestamps in Eastern Time (ET) without an offset. Both devices use the same sourcetype. The admin wants to ensure the _time is correct for both devices. What is the best approach?

Use a search-time eval to adjust the _time for one of the devices.

Set the TZ attribute to 'America/New_York' and hope Device A's timestamps are interpreted correctly.

Set the TZ attribute to 'UTC' and hope Device B's timestamps are interpreted correctly.

Create two separate sourcetypes, one for each device, and configure the TZ attribute accordingly.

What does Splunk use to determine the event time when a timestamp format is ambiguous?

The timestamp format defined in the sourcetype's props.conf

The time zone of the Splunk indexer

The first character of the timestamp

SplunkEnterprise Certified Admin

Domain 5Objective 3

Explain How Timestamps and Time Zones Are Extracted or Assigned to Events SPLK-1003 Practice Questions (Page 3)

Part of the Parsing and Data Manipulation domain, which makes up ~29% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

5concepts

Questions 11–15

11expert · hard
A Splunk admin is configuring a sourcetype for logs from a device that sends timestamps in UTC. However, due to a network issue, the events are sometimes delayed by several hours. The admin wants to ensure that searches for 'last 15 minutes' correctly include events that were generated in the last 15 minutes, even if they were indexed later. What is the most important configuration to achieve this?
Select an answer first
12expert · hard
An admin is ingesting logs from two different devices. Device A sends timestamps in UTC, and Device B sends timestamps in Eastern Time (ET) without an offset. Both devices use the same sourcetype. The admin wants to ensure the _time is correct for both devices. What is the best approach?
Select an answer first
13foundation · easy
Which of the following is a standard timestamp format that Splunk can parse automatically?
Select an answer first
14foundation · easy
What does Splunk use to determine the event time when a timestamp format is ambiguous?
Select an answer first
15foundation · easy
Which configuration file contains the TIME_FORMAT and TZ attributes for timestamp extraction?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1003” is a trademark of its owner, used for identification only.

Explain How Timestamps and Time Zones Are Extracted or Assigned to Events SPLK-1003 Practice Questions (Page 3)

Questions 11–15

An admin is ingesting logs from two different devices. Device A sends timestamps in UTC, and Device B sends timestamps in Eastern Time (ET) without an offset. Both devices use the same sourcetype. The admin wants to ensure the _time is correct for both devices. What is the best approach?

Which of the following is a standard timestamp format that Splunk can parse automatically?

What does Splunk use to determine the event time when a timestamp format is ambiguous?

Which configuration file contains the TIME_FORMAT and TZ attributes for timestamp extraction?

Keep studying — Parsing and Data Manipulation