SPLK-2002 practice questions 31–40

1. Question 31 · 167 in bank

   A deployable app is configured containing a monitor input for the /var/log directory. The server class was created in Forwarder Management instead of using the Add Data > Forward page. It is confirmed that the app is being deployed to the expected Linux deployment clients, but no /var/log events are being forwarded, even though other events from previously deployed inputs are being forwarded from the same clients. What is most likely causing this problem?

   • AThe Restart Splunkd option is not enabled in the server class.
   • BThe exclude list is overriding the include list in the server class.
   • CAn outputs.conf file was not included in the deployable app.
   • DA receiving port is not enabled on the target indexers.

   Show answer

   Answer: A

   Next question

2. Question 32 · 167 in bank

   Which component in the splunkd.log will log information related to bad event breaking?

   • AAudittrail
   • BEventBreaking
   • CIndexingPipeline
   • DAggregatorMiningProcessor

   Show answer

   Answer: D

   Next question

3. Question 33 · 167 in bank

   Which Splunk server role regulates the functioning of indexer cluster?

   • AIndexer
   • BDeployer
   • CMaster Node
   • DMonitoring Console

   Show answer

   Answer: C

   Next question

4. Question 34 · 167 in bank

   A new Splunk Enterprise deployment is being architected, and the customer wants to ensure that the data to be indexed is encrypted. Where should TLS be turned on in the Splunk deployment?

   • AIndexer cluster peer nodes.
   • BBrowser to Splunk Web.
   • CDeployment server to deployment clients.
   • DSplunk forwarders to indexers.

   Show answer

   Answer: D

   Next question

5. Question 35 · 167 in bank

   When adding or rejoining a member to a search head cluster, the following error is displayed: Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member. What corrective action should be taken?

   • ARestart the search head.
   • BRun the splunk apply shcluster-bundle command from the deployer.
   • CRun the clean raft command on all members of the search head cluster.
   • DRun the splunk resync shcluster-replicated-config command on this member.

   Show answer

   Answer: D

   Next question

6. Question 36 · 167 in bank

   What is the expected performance reduction when architecting Splunk in a virtualized environment instead of a physical environment?

   • AUp to 15%
   • BBetween 20% and 45%
   • C0%
   • D50%

   Show answer

   Answer: A

   Next question

7. Question 37 · 167 in bank

   Which of the following commands is used to clear the KV store?

   • Asplunk clean kvstore
   • Bsplunk clear kvstore
   • Csplunk delete kvstore
   • Dsplunk reinitialize kvstore

   Show answer

   Answer: A

   Next question

8. Question 38 · 167 in bank

   Based on the data sizing and retention parameters listed below, which of the following will correctly calculate the index storage required? • Daily rate = 20 GB / day • Compress factor = 0.5 • Retention period = 30 days • Padding = 100 GB

   • A20 / 0.5 * 30 + 100 = 1300 GB
   • B20 * 0.5 * 30 + 100 = 400 GB
   • C(20 * 30 + 100) * 0.5 = 350 GB
   • D20 * 30 + 100 = 700 GB

   Show answer

   Answer: B

   Next question

9. Question 39 · 167 in bank

   Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

   • AIncrease the maximum number of hot buckets in indexes.conf
   • BIncrease the number of parallel ingestion pipelines in server.conf
   • CDecrease the maximum size of the search pipelines in limits.conf
   • DDecrease the maximum concurrent scheduled searches in limits.conf

   Show answer

   Answer: B

   Next question

10. Question 40 · 167 in bank

    The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

    • Arawdata is: 10%, tsidx is: 40%
    • Brawdata is: 15%, tsidx is: 35%
    • Crawdata is: 35%, tsidx is: 15%
    • Drawdata is: 40%, tsidx is: 10%

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 31. 167 questions available.