A Splunk admin notices that after a forwarder crash, some files are being re-indexed from the beginning, causing duplicate events. They suspect the fishbucket index is corrupted. What should they do to resolve this while minimizing data loss?

Delete the fishbucket index and restart the forwarder

Run 'splunk fsck' on the fishbucket index to check and repair it

Increase the frozenTimePeriodInSecs for the fishbucket

Stop monitoring all files and start again

A company must retain security logs for 7 years for compliance, but storage costs are a concern. The Splunk admin needs to keep the data searchable for the first year, then archive it to low-cost storage for the remaining 6 years, with the ability to restore it if needed. Which configuration best meets these requirements?

Set coldToFrozenScript to delete data

Set frozenTimePeriodInSecs to 220903200

Set maxDataSize to a very low value

Set frozenTimePeriodInSecs to 31536000 and configure coldToFrozenScript to archive to low-cost storage

A company's compliance policy requires that all data be deleted from Splunk after 90 days. The Splunk admin needs to configure the index to automatically delete data that is older than 90 days. What should they do?

Set homePath to a temporary directory

Set frozenTimePeriodInSecs to 7776000

Set coldToFrozenScript to a script that deletes data

After running 'splunk fsck', a Splunk admin sees a report that some buckets have inconsistencies. What is the recommended next step to resolve these inconsistencies?

Delete the inconsistent buckets

Restart Splunk and hope the issue resolves

Run 'splunk fsck -repair' to fix the buckets

In a Splunk index, what is the primary purpose of the 'tsidx' file within a bucket?

To store the raw event data for retrieval

To enable fast search by mapping terms to event locations

To store configuration settings for the index

To track the bucket's lifecycle state (hot, warm, cold, etc.)

SplunkEnterprise Certified Admin

Domain 2Objective 1

Index Management SPLK-1003 Practice Questions (Page 3)

Part of the Indexes, Users, and Authentication domain, which makes up ~13% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

6concepts

Questions 11–15

11expert · hard
A Splunk admin notices that after a forwarder crash, some files are being re-indexed from the beginning, causing duplicate events. They suspect the fishbucket index is corrupted. What should they do to resolve this while minimizing data loss?
Select an answer first
12expert · hard
A company must retain security logs for 7 years for compliance, but storage costs are a concern. The Splunk admin needs to keep the data searchable for the first year, then archive it to low-cost storage for the remaining 6 years, with the ability to restore it if needed. Which configuration best meets these requirements?
Select an answer first
13application · medium
A company's compliance policy requires that all data be deleted from Splunk after 90 days. The Splunk admin needs to configure the index to automatically delete data that is older than 90 days. What should they do?
Select an answer first
14application · medium
After running 'splunk fsck', a Splunk admin sees a report that some buckets have inconsistencies. What is the recommended next step to resolve these inconsistencies?
Select an answer first
15foundation · easy
In a Splunk index, what is the primary purpose of the 'tsidx' file within a bucket?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1003” is a trademark of its owner, used for identification only.