Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Splunk
  5. SPLK-1005

Splunk SPLK-1005 Exam
Splunk Cloud Certified Admin (Page 6 )

Updated On: 1-Feb-2026
Page 3 of 17
PDF with 80 Questions

Which monitor statement will retrieve only files that start with "access" in the directory /opt/log/ww2/?

  1. [monitor:///opt/lug/.../access]
  2. [monitor:///opt/log/www2/access*]
  3. [monitor:///opt/log/www2/]
  4. [monitor:///opt/log/.../]

Answer(s): B

Explanation:

The correct monitor statement to retrieve only files that start with "access" in the directory /opt/log/www2/ is [monitor:///opt/log/www2/access*]. This configuration specifically targets files that begin with the name "access" and will match any such files within that directory, such as

"access.log".
Splunk Documentation


Reference:

Monitor files and directories



In what scenarios would transforms.conf be used?

  1. Per-Event Index Routing, Applying Event Types, SEOCMD operations
  2. Per-Event Sourcetype, Per-Event Host Name, Per-Event Index Routing
  3. Per-Event Host Name, Per-Event Index Rooting, SEDCMD operations
  4. Per-Event Sourcetype, Per-Event Index Routing, Applying Event Types

Answer(s): B

Explanation:

transforms.conf is used for various advanced data processing tasks in Splunk, including:
Per-Event Sourcetype: Dynamically assigning a sourcetype based on event content. Per-Event Host Name: Dynamically setting the host field based on event content. Per-Event Index Routing: Directing specific events to different indexes based on their content. Option B correctly identifies these common uses of transforms.conf. Splunk Documentation


Reference:

transforms.conf - Configuration



For the following data, what would be the correct attribute/value oair to use to successfully extract the correct timestamp from all the events?

  1. TIMK_FORMAT = %b %d %H:%M:%S %z
  2. DATETIME CONFIG = %Y-%m-%d %H:%M:%S %2
  3. TIME_FORMAT = %b %d %H:%M:%S
  4. DATETIKE CONFIG = Sb %d %H:%M:%S

Answer(s): C

Explanation:

The correct attribute/value pair to successfully extract the timestamp from the provided events is

TIME_FORMAT = %b %d %H:%M:%S. This format corresponds to the structure of the timestamps in the provided data:
%b represents the abbreviated month name (e.g., Sep).
%d represents the day of the month.
%H:%M:%S represents the time in hours, minutes, and seconds. This format will correctly extract timestamps like "Sep 12 06:11:58". Splunk Documentation


Reference:

Configure Timestamp Recognition



Which of the following is the default bandwidth limit in the Splunk Universal Forwarder credentials package?

  1. 0KBps
  2. 256 KBps
  3. 512 KBps
  4. 1024 KBps

Answer(s): B

Explanation:

The default bandwidth limit in the Splunk Universal Forwarder is set to 256 KBps. This setting is in place to prevent the forwarder from overwhelming network resources, and it can be adjusted as necessary based on the deployment's specific needs.
Splunk Documentation


Reference:

Universal Forwarder Configuration



Which of the following app installation scenarios can be achieved without involving Splunk Support?

  1. Deploy premium apps.
  2. Install apps via the Request Install button.
  3. Install apps via self-service.
  4. Install apps that have not gone through the vetting process.

Answer(s): C

Explanation:

In Splunk Cloud, you can install apps via self-service, which allows you to install certain approved apps without involving Splunk Support. This self-service capability is provided for apps that have already been vetted and approved for use in the Splunk Cloud environment. Option A typically requires support involvement because premium apps often need licensing or other special considerations.
Option B might involve the Request Install button, but some apps might still require vetting or support approval.
Option D is incorrect because apps that have not gone through the vetting process cannot be installed via self-service and would require Splunk Support for evaluation and approval. Splunk Documentation


Reference:

Install apps on Splunk Cloud



Viewing page 6 of 17
Viewing questions 26 - 30 out of 80 questions



Post your Comments and Discuss Splunk SPLK-1005 exam prep with other Community members:

Join the SPLK-1005 Discussion