SPLK-1003 Practice Questions

These questions cover distributed Splunk architecture and data management — topics that appear throughout SPLK-1003 and where the exam tests practical knowledge of how to configure Splunk components, not just identify them.

Question 1

A compliance requirement states that credit card numbers (16-digit sequences) must never be stored in the Splunk index. The data arrives via a Universal Forwarder. Which approach masks the data before indexing?

• A) Create a post-indexing search that deletes events containing credit card patterns
• B) Configure a SEDCMD or TRANSFORMS stanza in props.conf referencing a transforms.conf regex replacement
• C) Enable PCI compliance mode in server.conf
• D) Use a scripted input to pre-process data before forwarding

Answer: B — SEDCMD or TRANSFORMS in props.conf

Data masking in Splunk happens at index time on the indexer (or heavy forwarder) before data is written to disk. Two approaches:

Option 1 — SEDCMD (simpler, inline regex):

# props.conf
[source::payment_logs]
SEDCMD-mask-cc = s/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/XXXX-XXXX-XXXX-XXXX/g

Option 2 — TRANSFORMS (more control):

# props.conf
[source::payment_logs]
TRANSFORMS-mask-cc = mask-credit-card

# transforms.conf
[mask-credit-card]
REGEX = \b(\d{4})[\s-]?\d{4}[\s-]?\d{4}[\s-]?(\d{4})\b
FORMAT = $1-XXXX-XXXX-$2
DEST_KEY = _raw

There is no PCI mode in server.conf. Post-indexing deletion is unreliable — the data has already been stored. Scripted inputs can work but require maintaining custom code and don't integrate with Splunk's built-in transform pipeline.

Question 2

In a distributed Splunk deployment with multiple indexers, what is the primary function of the search head?

• A) To receive and store incoming data from Universal Forwarders
• B) To manage deployment configurations pushed to Universal Forwarders
• C) To coordinate searches across indexers and merge results for the user
• D) To maintain the licence for the entire deployment

Answer: C — Coordinate searches and merge results

The search head receives search requests from users, fans them out to all relevant indexers simultaneously, collects the partial results from each indexer, merges and sorts them, and returns the final result set to the user.

Distributed Splunk component roles:

The search head has no data storage role — all data lives on indexers. The deployment server handles forwarder config management. The licence master is a separate role (though it can be co-located on the search head).

Question 3

A distributed Splunk environment has one search head, four indexers, and ten Universal Forwarders. Which instance should be designated as the licence master?

• A) Each indexer should hold its own licence independently
• B) The search head should always be the licence master
• C) One instance — typically the search head or a dedicated standalone — should be the licence master
• D) The deployment server is automatically the licence master

Answer: C — One designated instance, often the search head or a dedicated standalone

In a distributed deployment, licence usage is tracked centrally by a single licence master instance. All other Splunk instances (indexers, search heads, forwarders) are configured as licence slaves and report their daily indexing volume to the master.

Common licence master placements:

• Search head (common in smaller deployments — fewer components to manage)
• Dedicated standalone instance (recommended for larger deployments — isolates licence management from search performance)
• Cluster master in indexer cluster deployments

Each indexer holding its own licence is not a valid Splunk architecture. There's no automatic designation — you configure the licence master URL in server.conf on each slave:

# server.conf on each licence slave
[license]
master_uri = https://licence-master:8089

The deployment server manages Universal Forwarder configurations — it has no licence master function.

Key Takeaways

• Data masking happens at index time via SEDCMD or TRANSFORMS in props.conf — post-indexing deletion is not reliable for compliance
• Search head coordinates distributed searches across indexers; it stores no data
• One licence master per deployment; all other instances are licence slaves reporting to it