An admin is editing `props.conf` for a sourcetype. The file contains two stanzas for the same sourcetype: `[sourcetype:access]` and `[access]`. The admin sets `TIME_PREFIX` in the `[sourcetype:access]` stanza and `MAX_TIMESTAMP_LOOKAHEAD` in the `[access]` stanza. When Splunk evaluates this configuration, what happens?

The `[sourcetype:access]` stanza takes precedence, and `MAX_TIMESTAMP_LOOKAHEAD` is ignored.

The `[access]` stanza takes precedence, and `TIME_PREFIX` is ignored.

Splunk throws a configuration error because of duplicate stanzas.

Both stanzas are merged, and both settings apply.

A Splunk admin needs to enforce a company-wide default for the `max_memtable_bytes` setting in `limits.conf`. They place the setting in `$SPLUNK_HOME/etc/system/local/limits.conf`. However, a custom app called `app_performance` has the same setting in `$SPLUNK_HOME/etc/apps/app_performance/default/limits.conf`. The admin wants the system-level setting to take precedence. What should the admin do?

Move the setting to `$SPLUNK_HOME/etc/apps/app_performance/local/limits.conf`.

Remove the setting from the app's default directory and rely on the system local setting.

Change the setting in `$SPLUNK_HOME/etc/system/default/limits.conf`.

Set the same value in `$SPLUNK_HOME/etc/apps/app_performance/local/limits.conf` and `$SPLUNK_HOME/etc/system/local/limits.conf`.

A Splunk admin changed a setting in `$SPLUNK_HOME/etc/apps/myapp/local/inputs.conf` to increase the `interval` for a scripted input. After restarting Splunk, the change does not take effect. The admin checks `$SPLUNK_HOME/etc/apps/myapp/default/inputs.conf` and sees the same input with a different interval. What is the most likely cause?

The admin needs to run `splunk reload` instead of restarting.

The app's default directory has higher precedence than the local directory.

The admin edited the wrong file; they should edit `$SPLUNK_HOME/etc/apps/myapp/default/inputs.conf`.

The input is also defined in `$SPLUNK_HOME/etc/system/local/inputs.conf` with a higher precedence.

When the same setting is defined in both an app's default directory and a user's local directory, which setting takes effect?

The app's default directory setting

The user's local directory setting

Both settings are merged, with the app setting taking priority

A Splunk admin has a custom app `security_app` that sets `max_lines` in `props.conf` in its `default` directory. The admin wants to override this for all users in the `SOC` role. They create a `props.conf` in `$SPLUNK_HOME/etc/users/SOC/props.conf` and set `max_lines`. However, the change does not take effect. What is the most likely reason?

The user-level configuration directory is not a valid location for `props.conf`.

The user-level directory should be `$SPLUNK_HOME/etc/users/SOC/local/props.conf`.

The admin needs to restart Splunk after making the change.

The app's default directory has higher precedence than the user-level directory.

SplunkEnterprise Certified Admin

Domain 1Objective 6

Understand Configuration Precedence SPLK-1003 Practice Questions (Page 1)

Part of the Splunk Administration and Configuration domain, which makes up ~31% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 10 practice questions to prepare you well beyond it. (estimate)

10questions here

2free pages

5concepts

Questions 1–5

1application · medium
An admin is editing `props.conf` for a sourcetype. The file contains two stanzas for the same sourcetype: `[sourcetype:access]` and `[access]`. The admin sets `TIME_PREFIX` in the `[sourcetype:access]` stanza and `MAX_TIMESTAMP_LOOKAHEAD` in the `[access]` stanza. When Splunk evaluates this configuration, what happens?
Select an answer first
2application · medium
A Splunk admin needs to enforce a company-wide default for the `max_memtable_bytes` setting in `limits.conf`. They place the setting in `$SPLUNK_HOME/etc/system/local/limits.conf`. However, a custom app called `app_performance` has the same setting in `$SPLUNK_HOME/etc/apps/app_performance/default/limits.conf`. The admin wants the system-level setting to take precedence. What should the admin do?
Select an answer first
3expert · hard
A Splunk admin changed a setting in `$SPLUNK_HOME/etc/apps/myapp/local/inputs.conf` to increase the `interval` for a scripted input. After restarting Splunk, the change does not take effect. The admin checks `$SPLUNK_HOME/etc/apps/myapp/default/inputs.conf` and sees the same input with a different interval. What is the most likely cause?
Select an answer first
4foundation · easy
When the same setting is defined in both an app's default directory and a user's local directory, which setting takes effect?
Select an answer first
5application · hard
A Splunk admin has a custom app `security_app` that sets `max_lines` in `props.conf` in its `default` directory. The admin wants to override this for all users in the `SOC` role. They create a `props.conf` in `$SPLUNK_HOME/etc/users/SOC/props.conf` and set `max_lines`. However, the change does not take effect. What is the most likely reason?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1003” is a trademark of its owner, used for identification only.

Understand Configuration Precedence SPLK-1003 Practice Questions (Page 1)

Questions 1–5

When the same setting is defined in both an app's default directory and a user's local directory, which setting takes effect?

Keep studying — Splunk Administration and Configuration