SPLK-2002 practice questions 61–70

1. Question 61 · 167 in bank

   Which of the following can a Splunk diag contain?

   • ASearch history, Splunk users and their roles, running processes, indexed data
   • BServer specs, current open connections, internal Splunk log files, index listings
   • CKV store listings, internal Splunk log files, search peer bundles listings, indexed data
   • DSplunk platform configuration details, Splunk users and their roles, current open connections, index listings

   Show answer

   Answer: B

   Next question

2. Question 62 · 167 in bank

   The performance of a specific search is performing poorly. The search must run over All Time and is expected to have very few results. Analysis shows that the search accesses a very large number of buckets in a large index. What step would most significantly improve the performance of this search?

   • AChange this to a real-time search using an All Time window.
   • BIncrease the number of indexing pipelines.
   • CIncrease the disk I/O hardware performance.
   • DSet indexed_realtime_use_by_default = true in limits.conf.

   Show answer

   Answer: C

   Next question

3. Question 63 · 167 in bank

   Which of the following are true statements about Splunk indexer clustering?

   • AAll peer nodes must run exactly the same Splunk version.
   • BThe master node must run the same or a later Splunk version than search heads.
   • CThe peer nodes must run the same or a later Splunk version than the master node.
   • DThe search head must run the same or a later Splunk version than the peer nodes.

   Show answer

   Answer: A

   Next question

4. Question 64 · 167 in bank

   Which Splunk log file would be the least helpful in troubleshooting a crash?

   • Asplunk_instrumentation.log
   • Bsplunkd.log
   • Csplunkd_stderr.log
   • Dcrash-2022-05-13-11:42:57.log

   Show answer

   Answer: A

   Next question

5. Question 65 · 167 in bank

   A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

   • ATwo indexers not in a cluster, assuming users run many long searches.
   • BThree indexers not in a cluster, assuming a long data retention period.
   • CTwo indexers clustered, assuming high availability is the greatest priority.
   • DTwo indexers clustered, assuming a high volume of saved/scheduled searches.

   Show answer

   Answer: C

   Next question

6. Question 66 · 167 in bank

   To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

   • Aadhoc_searchhead = true (on all members)
   • Badhoc_searchhead = true (on the current captain)
   • Ccaptain_is_adhoc_searchhead = true (on all members)
   • Dcaptain_is_adhoc_searchhead = true (on the current captain)

   Show answer

   Answer: C

   Next question

7. Question 67 · 167 in bank

   Other than high availability, which of the following is a benefit of search head clustering?

   • AInput settings are synchronized between search heads.
   • BAutomatic replication of user knowledge objects.
   • CAllows indexers to maintain multiple searchable copies of all data.
   • DFewer network ports are required to be opened between search heads.

   Show answer

   Answer: B

   Next question

8. Question 68 · 167 in bank

   At which default interval does metrics.log generate a periodic report regarding license utilization?

   • A10 seconds
   • B30 seconds
   • C60 seconds
   • D300 seconds

   Show answer

   Answer: B

   Next question

9. Question 69 · 167 in bank

   Which of the following is not facilitated by the deployer?

   • AMigration of app and user configurations into the search head cluster.
   • BDistribute non-replicated, non-runtime configuration updates.
   • CReplication of knowledge objects.
   • DDeployment of baseline app configurations.

   Show answer

   Answer: C

   Next question

10. Question 70 · 167 in bank

    Which of the following is a good practice for a search head cluster deployer?

    • AThe deployer only distributes configurations to search head cluster members when they "phone home".
    • BThe deployer must be used to distribute non-replicable configurations to search head cluster members.
    • CThe deployer must distribute configurations to search head cluster members to be valid configurations.
    • DThe deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 61. 167 questions available.