SplunkEnterprise Certified Admin
Domain 1Objective 5
Understand Configuration Layering SPLK-1003 Practice Questions (Page 1)
Part of the Splunk Administration and Configuration domain, which makes up ~31% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)
12questions here
3free pages
6concepts
Questions 1–5
- 1
Which type of configuration change in Splunk requires a restart of the Splunk services to take effect?
Select an answer first - 2
An admin changes a `max_lines` setting in props.conf for a sourcetype and wants to apply the change without restarting Splunk. Which command should the admin run?
Select an answer first - 3
Which configuration context in Splunk is applied to all users and is typically used for global customizations?
Select an answer first - 4
In the Splunk configuration file hierarchy, which directory level has the highest precedence when settings are merged?
Select an answer first - 5
A Splunk admin has a search head with an app 'hr' that defines a `[hr_logs]` stanza in its default/props.conf with `TIME_FORMAT = %Y-%m-%d`. A user reports that their searches show incorrect timestamps. The admin checks the user's directory and finds a props.conf with a `[hr_logs]` stanza that has `TIME_FORMAT = %m/%d/%Y`. The admin also checks the app's local/props.conf and finds no `[hr_logs]` stanza. What is the effective TIME_FORMAT for this user?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1003” is a trademark of its owner, used for identification only.