SPLK-2002 practice questions 11–20

1. Question 11 · 167 in bank

   Which of the following is a best practice to maximize indexing performance?

   • AUse automatic sourcetyping.
   • BUse the Splunk default settings.
   • CNot use pre-trained source types.
   • DMinimize configuration generality.

   Show answer

   Answer: D

   Next question

2. Question 12 · 167 in bank

   What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

   • ADistributes apps to SHC members.
   • BBootstraps a clean Splunk install for a SHC.
   • CDistributes non-search related and manual configuration file changes.
   • DDistributes runtime knowledge object changes made by users across the SHC.

   Show answer

   Answer: A

   Next question

3. Question 13 · 167 in bank

   Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

   • ASystem local directory.
   • BSystem default directory.
   • CApp local directories, in ASCII order.
   • DApp default directories, in ASCII order.

   Show answer

   Answer: A

   Next question

4. Question 14 · 167 in bank

   When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

   • AAuto
   • BNone
   • CTrue
   • DFalse

   Show answer

   Answer: D

   Next question

5. Question 15 · 167 in bank

   Which of the following should be included in a deployment plan?

   • ABusiness continuity and disaster recovery plans.
   • BCurrent logging details and data source inventory.
   • CCurrent and future topology diagrams of the IT environment.
   • DA comprehensive list of stakeholders, either direct or indirect.

   Show answer

   Answer: B

   Next question

6. Question 16 · 167 in bank

   In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

   • ASPLUNK_HOME/var/lib/searchpeers
   • BSPLUNK_HOME/var/log/searchpeers
   • CSPLUNK_HOME/var/run/searchpeers
   • DSPLUNK_HOME/var/spool/searchpeers

   Show answer

   Answer: C

   Next question

7. Question 17 · 167 in bank

   Select 2

   Which two sections can be expanded using the Search Job Inspector?

   • AExecution costs.
   • BSaved search history.
   • CSearch job properties.
   • DOptimization suggestions.

   Show answer

   Answer: AC

   Next question

8. Question 18 · 167 in bank

   Select 2

   A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

   • AVia Splunk Web.
   • BDirectly edit SPLUNK_HOME/etc/system/local/server.conf
   • CRun a splunk edit cluster-config command from the CLI.
   • DDirectly edit SPLUNK_HOME/etc/system/default/server.conf

   Show answer

   Answer: BC

   Next question

9. Question 19 · 167 in bank

   Select 2

   Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

   • AREPORT
   • BLINE_BREAKER
   • CANNOTATE_PUNCT
   • DSHOULD_LINEMERGE

   Show answer

   Answer: BC

   Next question

10. Question 20 · 167 in bank

    Select 2

    Which of the following statements describe search head clustering? (Select all that apply.)

    • AA deployer is required.
    • BAt least three search heads are needed.
    • CSearch heads must meet the high-performance reference server requirements.
    • DThe deployer must have sufficient CPU and network resources to process service requests and push configurations.

    Show answer

    Answer: AB

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 11. 167 questions available.