Splunk SPLK-2002 Exam Questions

Questions for the SPLK-2002 were updated on : Oct 11 ,2024

Page 1 out of 6. Viewing questions 1-15 out of 90

Question 1

Which of the following will cause the greatest reduction in disk size requirements for a cluster of N
indexers running Splunk Enterprise Security?

  • A. Setting the cluster search factor to N-1.
  • B. Increasing the number of buckets per index.
  • C. Decreasing the data model acceleration range.
  • D. Setting the cluster replication factor to N-1.
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 2

Stakeholders have identified high availability for searchable data as their top priority. Which of the
following best addresses this requirement?

  • A. Increasing the search factor in the cluster.
  • B. Increasing the replication factor in the cluster.
  • C. Increasing the number of search heads in the cluster.
  • D. Increasing the number of CPUs on the indexers in the cluster.
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

Search dashboards in the Monitoring Console indicate that the distributed deployment is
approaching its capacity. Which of the following options will provide the most search performance
improvement?

  • A. Replace the indexer storage to solid state drives (SSD).
  • B. Add more search heads and redistribute users based on the search type.
  • C. Look for slow searches and reschedule them to run during an off-peak time.
  • D. Add more search peers and make sure forwarders distribute data evenly across all indexers.
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are
complaining that the events are inconsistently formatted for a web sourcetype. Further investigation
reveals that not all web logs flow through the same infrastructure: some of the data goes through
heavy forwarders and some of the forwarders are managed by another department.
Which of the following items might be the cause for this issue?

  • A. The search head may have different configurations than the indexers.
  • B. The data inputs are not properly configured across all the forwarders.
  • C. The indexers may have different configurations than the heavy forwarders.
  • D. The forwarders managed by the other department are an older version than the rest.
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no
enforcement license on the same license master. How much data can the customer ingest before
search is locked out?

  • A. 300GB. After this limit, search is locked out.
  • B. 500GB. After this limit, search is locked out.
  • C. 800GB. After this limit, search is locked out.
  • D. Search is not locked out. Violations are still recorded.
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

  • A. Distributes apps to SHC members.
  • B. Bootstraps a clean Splunk install for a SHC.
  • C. Distributes non-search related and manual configuration file changes.
  • D. Distributes runtime knowledge object changes made by users across the SHC.
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the
SHOULD_LINEMERGE attribute should be set to what?

  • A. Auto
  • B. None
  • C. True
  • D. False
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

Which of the following should be included in a deployment plan?

  • A. Business continuity and disaster recovery plans.
  • B. Current logging details and data source inventory.
  • C. Current and future topology diagrams of the IT environment.
  • D. A comprehensive list of stakeholders, either direct or indirect.
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

  • A. Via Splunk Web.
  • B. Directly edit SPLUNK_HOME/etc/system/local/server.conf
  • C. Run a splunk edit cluster-config command from the CLI.
  • D. Directly edit SPLUNK_HOME/etc/system/default/server.conf
Answer:

A,B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

  • A. REPORT
  • B. LINE_BREAKER
  • C. ANNOTATE_PUNCT
  • D. SHOULD_LINEMERGE
Answer:

B,D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 11

Which of the following are client filters available in serverclass.conf? (Select all that apply.)

  • A. DNS name.
  • B. IP address.
  • C. Splunk server role.
  • D. Platform (machine type).
Answer:

A,B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 12

What log file would you search to verify if you suspect there is a problem interpreting a regular
expression in a monitor stanza?

  • A. btool.log
  • B. metrics.log
  • C. splunkd.log
  • D. tailing_processor.log
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk
deployment?

  • A. btool
  • B. DiagGen
  • C. SPL Clinic
  • D. Monitoring Console
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one
searchable copy at site2, and a total of four searchable copies?

  • A. site_search_factor = origin:2, site1:2, total:4
  • B. site_search_factor = origin:2, site2:1, total:4
  • C. site_replication_factor = origin:2, site1:2, total:4
  • D. site_replication_factor = origin:2, site2:1, total:4
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

  • A. Adding search peers increases the maximum size of search results.
  • B. Adding RAM to an existing search heads provides additional search capacity.
  • C. Adding search peers increases the search throughput as search load increases.
  • D. Adding search heads provides additional CPU cores to run more concurrent searches.
Answer:

B,D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2