100+ Free Splunk Cloud Certified Admin Practice Questions

Splunk Cloud Overview

Describe Splunk Cloud topology, the admin's responsibilities on a managed platform, differences from Splunk Enterprise, and the distinction between Self-Service Cloud and Managed Cloud.

Index Management

Define and create indexes through Splunk Web, REST, or the ACS API. Delete events using the can_delete role. Monitor indexing activity in the Cloud Monitoring Console and License Usage Report View.

User Authentication and Authorization

Administer Splunk roles and capabilities. Integrate Splunk Cloud with LDAP, Active Directory, or SAML, with SAML SSO as the recommended enterprise pattern and IdP group-to-role mapping.

Splunk Configuration Files

Review configuration file precedence, default vs local directories, and the boundary between index-time and search-time processing on customer-managed Splunk components.

Getting Data in Cloud

Use the Splunk Cloud data input process, choose the right forwarder type, install the Universal Forwarder Credentials Package, configure forwarder-to-Cloud connections, and use IDM-hosted modular inputs and Splunk Connect for Syslog (SC4S) for scaled syslog ingestion.

Forwarder Management

Run a customer-managed Splunk Deployment Server, build deployment-apps under $SPLUNK_HOME/etc/deployment-apps, define server classes in serverclass.conf, and monitor forwarders via Forwarder Management and _internal phonehome events.

Monitor Inputs

Create file and directory monitor inputs, use allowlist/denylist filters, override sourcetype and host, manage fishbucket and crcSalt behavior, and apply optional monitor settings for first-time ingestion.

Network and Other Inputs

Configure [tcp://] and [udp://] inputs, build basic scripted inputs with [script://] and interval, identify Windows input types (WinEventLog, WinHostMon, performance counters), and ingest token-authenticated events with HEC including indexer acknowledgement.

Fine-tuning Inputs

Understand default input-phase processing, force sourcetype with the input attribute, set CHARSET for non-ASCII data, and reason about pipeline behavior before parsing begins.

Parsing Phase and Data Preview

Tune LINE_BREAKER and SHOULD_LINEMERGE, control timestamps with TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD, manage time zones, and validate parsing using Splunk Web Data Preview before deploying changes.

Manipulating Raw Data

Define transformations in props.conf and transforms.conf, mask sensitive data with SEDCMD at index time, route events using DEST_KEY = MetaData:Sourcetype or _MetaData:Index, and drop unwanted events using DEST_KEY = queue and FORMAT = nullQueue on a heavy forwarder.

Installing and Managing Apps

Install Splunkbase apps via Self-Service App Install, upload private apps that pass Splunk AppInspect vetting, and manage app lifecycles through Splunk Web and the ACS API rather than direct filesystem access.

Working with Splunk Cloud Support

Isolate problems before contacting support, gather sids, Job Inspector output, sample events, and recent change context, and file cases through the Splunk Customer Support Portal with clear scope and impact.