Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Splunk
  5. SPLK-1003

Splunk SPLK-1003 Exam Questions
Splunk Enterprise Certified Admin (Page 5 )

Updated On: 28-Feb-2026
Page 5 of 39
PDF with 220 Questions

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

  1. Slash notation
  2. Regular expression
  3. Irregular expression
  4. Wildcard-only expression

Answer(s): B

Explanation:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdat a#Include_or_exclude_specific_incoming_data



What is required when adding a native user to Splunk? (select all that apply)

  1. Password
  2. Username
  3. Full Name
  4. Default app

Answer(s): A,B

Explanation:

According to the Splunk system admin course PDF, When adding native users, Username and Password ARE REQUIRED



What are the minimum required settings when creating a network input in Splunk?

  1. Protocol, port number
  2. Protocol, port, location
  3. Protocol, username, port
  4. Protocol, IP. port number

Answer(s): A

Explanation:

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf

[tcp://<remote server>:<port>]
*Configures the input to listen on a specific TCP network port. *If a <remote server> makes a connection to this instance, the input uses this stanza to configure itself.
*If you do not specify <remote server>, this stanza matches all connections on the specified port. *Generates events with source set to "tcp:<port>", for example: tcp:514

*If you do not specify a sourcetype, generates events with sourcetype set to "tcp-raw"



Which Splunk component requires a Forwarder license?

  1. Search head
  2. Heavy forwarder
  3. Heaviest forwarder
  4. Universal forwarder

Answer(s): B



Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?

  1. _TCP_ROUTING
  2. _INDEXER_LIST
  3. _INDEXER_GROUP
  4. _INDEXER ROUTING

Answer(s): A

Explanation:

https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Perform_se lective_indexing_and_forwarding
Specifies a comma-separated list of tcpout group names. Use this setting to selectively forward your data to specific indexers by specifying the tcpout groups that the forwarder should use when forwarding the data. Define the tcpout group names in the outputs.conf file in [tcpout:<tcpout_group_name>] stanzas. The groups present in defaultGroup in [tcpout] stanza in the outputs.conf file.






Post your Comments and Discuss Splunk SPLK-1003 exam dumps with other Community members:

Join the SPLK-1003 Discussion