March Special Sale - Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 575363r9

Welcome To DumpsPedia

SPLK-2002 Sample Questions Answers

Questions 4

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

Options:

A.

telnet

B.

tcpdump

C.

splunk btool

D.

splunk btprobe

Buy Now
Questions 5

When troubleshooting a situation where some files within a directory are not being indexed, the ignored files are discovered to have long headers. What is the first thing that should be added to inputs.conf?

Options:

A.

Decrease the value of initCrcLength.

B.

Add a crcSalt= attribute.

C.

Increase the value of initCrcLength.

D.

Add a crcSalt= attribute.

Buy Now
Questions 6

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

Options:

A.

REPORT

B.

LINE_BREAKER

C.

ANNOTATE_PUNCT

D.

SHOULD_LINEMERGE

Buy Now
Questions 7

New data has been added to a monitor input file. However, searches only show older data.

Which splunkd. log channel would help troubleshoot this issue?

Options:

A.

Modularlnputs

B.

TailingProcessor

C.

ChunkedLBProcessor

D.

ArchiveProcessor

Buy Now
Questions 8

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

Options:

A.

System local directory.

B.

System default directory.

C.

App local directories, in ASCII order.

D.

App default directories, in ASCII order.

Buy Now
Questions 9

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Options:

A.

Disables search site affinity.

B.

Sets all members to dynamic captaincy.

C.

Enables multisite search artifact replication.

D.

Enables automatic search site affinity discovery.

Buy Now
Questions 10

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

Options:

A.

Replace the indexer storage to solid state drives (SSD).

B.

Add more search heads and redistribute users based on the search type.

C.

Look for slow searches and reschedule them to run during an off-peak time.

D.

Add more search peers and make sure forwarders distribute data evenly across all indexers.

Buy Now
Questions 11

Which Splunk component is mandatory when implementing a search head cluster?

Options:

A.

Captain Server

B.

Deployer

C.

Cluster Manager

D.

RAFT Server

Buy Now
Questions 12

At which default interval does metrics.log generate a periodic report regarding license utilization?

Options:

A.

10 seconds

B.

30 seconds

C.

60 seconds

D.

300 seconds

Buy Now
Questions 13

Which CLI command converts a Splunk instance to a license slave?

Options:

A.

splunk add licenses

B.

splunk list licenser-slaves

C.

splunk edit licenser-localslave

D.

splunk list licenser-localslave

Buy Now
Questions 14

Users who receive a link to a search are receiving an "Unknown sid" error message when they open the link.

Why is this happening?

Options:

A.

The users have insufficient permissions.

B.

An add-on needs to be updated.

C.

The search job has expired.

D.

One or more indexers are down.

Buy Now
Questions 15

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

Options:

A.

Auto

B.

None

C.

True

D.

False

Buy Now
Questions 16

A monitored log file is changing on the forwarder. However, Splunk searches are not finding any new data that has been added. What are possible causes? (select all that apply)

Options:

A.

An admin ran splunk clean eventdata -index on the indexer.

B.

An admin has removed the Splunk fishbucket on the forwarder.

C.

The last 256 bytes of the monitored file are not changing.

D.

The first 256 bytes of the monitored file are not changing.

Buy Now
Questions 17

Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

Options:

A.

High performance SAN should never be used.

B.

Enable NFS for storing hot and warm buckets.

C.

The recommended RAID setup is RAID 10 (1 + 0).

D.

Virtualized environments are usually preferred over bare metal for Splunk indexers.

Buy Now
Questions 18

When should a Universal Forwarder be used instead of a Heavy Forwarder?

Options:

A.

When most of the data requires masking.

B.

When there is a high-velocity data source.

C.

When data comes directly from a database server.

D.

When a modular input is needed.

Buy Now
Questions 19

The master node distributes configuration bundles to peer nodes. Which directory peer nodes receive the bundles?

Options:

A.

apps

B.

deployment-apps

C.

slave-apps

D.

master-apps

Buy Now
Questions 20

Which of the following is a best practice to maximize indexing performance?

Options:

A.

Use automatic source typing.

B.

Use the Splunk default settings.

C.

Not use pre-trained source types.

D.

Minimize configuration generality.

Buy Now
Questions 21

Which search will show all deployment client messages from the client (UF)?

Options:

A.

index=_audit component=DC* host= | stats count by message

B.

index=_audit component=DC* host= | stats count by message

C.

index=_internal component= DC* host= | stats count by message

D.

index=_internal component=DS* host= | stats count by message

Buy Now
Questions 22

As a best practice, where should the internal licensing logs be stored?

Options:

A.

Indexing layer.

B.

License server.

C.

Deployment layer.

D.

Search head layer.

Buy Now
Questions 23

Several critical searches that were functioning correctly yesterday are not finding a lookup table today. Which log file would be the best place to start troubleshooting?

Options:

A.

btool.log

B.

web_access.log

C.

health.log

D.

configuration_change.log

Buy Now
Questions 24

A Splunk environment collecting 10 TB of data per day has 50 indexers and 5 search heads. A single-site indexer cluster will be implemented. Which of the following is a best practice for added data resiliency?

Options:

A.

Set the Replication Factor to 49.

B.

Set the Replication Factor based on allowed indexer failure.

C.

Always use the default Replication Factor of 3.

D.

Set the Replication Factor based on allowed search head failure.

Buy Now
Questions 25

To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

Options:

A.

Rolling restart completes.

B.

Master node rejoins the cluster.

C.

Captain joins or rejoins cluster.

D.

A peer node joins or rejoins the cluster.

Buy Now
Questions 26

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

Options:

A.

audit.log

B.

metrics.log

C.

disk_objects.log

D.

resource_usage.log

Buy Now
Questions 27

A customer is migrating 500 Universal Forwarders from an old deployment server to a new deployment server, with a different DNS name. The new deployment server is configured and running.

The old deployment server deployed an app containing an updated deploymentclient.conf file to all forwarders, pointing them to the new deployment server. The app was successfully deployed to all 500 forwarders.

Why would all of the forwarders still be phoning home to the old deployment server?

Options:

A.

There is a version mismatch between the forwarders and the new deployment server.

B.

The new deployment server is not accepting connections from the forwarders.

C.

The forwarders are configured to use the old deployment server in $SPLUNK_HOME/etc/system/local.

D.

The pass4SymmKey is the same on the new deployment server and the forwarders.

Buy Now
Questions 28

A search head cluster member contains the following in its server .conf. What is the Splunk server name of this member?

Options:

A.

node1

B.

shc4

C.

idxc2

D.

node3

Buy Now
Questions 29

Which of the following strongly impacts storage sizing requirements for Enterprise Security?

Options:

A.

The number of scheduled (correlation) searches.

B.

The number of Splunk users configured.

C.

The number of source types used in the environment.

D.

The number of Data Models accelerated.

Buy Now
Questions 30

Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

Options:

A.

kvstore.conf

B.

collection.conf

C.

collections.conf

D.

kvcollections.conf

Buy Now
Questions 31

Which command will permanently decommission a peer node operating in an indexer cluster?

Options:

A.

splunk stop -f

B.

splunk offline -f

C.

splunk offline --enforce-counts

D.

splunk decommission --enforce counts

Buy Now
Questions 32

The frequency in which a deployment client contacts the deployment server is controlled by what?

Options:

A.

polling_interval attribute in outputs.conf

B.

phoneHomeIntervalInSecs attribute in outputs.conf

C.

polling_interval attribute in deploymentclient.conf

D.

phoneHomeIntervalInSecs attribute in deploymentclient.conf

Buy Now
Questions 33

As of Splunk 9.0, which index records changes to . conf files?

Options:

A.

_configtracker

B.

_introspection

C.

_internal

D.

_audit

Buy Now
Questions 34

Which of the following Splunk deployments has the recommended minimum components for a high-availability search head cluster?

Options:

A.

2 search heads, 1 deployer, 2 indexers

B.

3 search heads, 1 deployer, 3 indexers

C.

1 search head, 1 deployer, 3 indexers

D.

2 search heads, 1 deployer, 3 indexers

Buy Now
Questions 35

A customer has a four site indexer cluster. The customer has requirements to store five copies of searchable data, with one searchable copy of data at the origin site, and one searchable copy at the disaster recovery site (site4).

Which configuration meets these requirements?

Options:

A.

site_replication_factor = origin:2, site4:l, total:3

B.

site_replication_factor = origin:l, site4:l, total:5

C.

site_search_factor = origin:2, site4:l, total:3

D.

site search factor = origin:1, site4:l, total:5

Buy Now
Questions 36

What is the best method for sizing or scaling a search head cluster?

Options:

A.

Estimate the maximum daily ingest volume in gigabytes and divide by the number of CPU cores per search head.

B.

Estimate the total number of searches per day and divide by the number of CPU cores available on the search heads.

C.

Divide the number of indexers by three to achieve the correct number of search heads.

D.

Estimate the maximum concurrent number of searches and divide by the number of CPU cores per search head.

Buy Now
Questions 37

Users are asking the Splunk administrator to thaw recently-frozen buckets very frequently. What could the Splunk administrator do to reduce the need to thaw buckets?

Options:

A.

Change f rozenTimePeriodlnSecs to a larger value.

B.

Change maxTotalDataSizeMB to a smaller value.

C.

Change maxHotSpanSecs to a larger value.

D.

Change coldToFrozenDir to a different location.

Buy Now
Questions 38

Where does the Splunk deployer send apps by default?

Options:

A.

etc/slave-apps//default

B.

etc/deploy-apps//default

C.

etc/apps//default

D.

etc/shcluster//default

Buy Now
Questions 39

How does the average run time of all searches relate to the available CPU cores on the indexers?

Options:

A.

Average run time is independent of the number of CPU cores on the indexers.

B.

Average run time decreases as the number of CPU cores on the indexers decreases.

C.

Average run time increases as the number of CPU cores on the indexers decreases.

D.

Average run time increases as the number of CPU cores on the indexers increases.

Buy Now
Questions 40

Which of the following is an indexer clustering requirement?

Options:

A.

Must use shared storage.

B.

Must reside on a dedicated rack.

C.

Must have at least three members.

D.

Must share the same license pool.

Buy Now
Questions 41

A Splunk instance has crashed, but no crash log was generated. There is an attempt to determine what user activity caused the crash by running the following search:

What does searching for closed_txn=0 do in this search?

Options:

A.

Filters results to situations where Splunk was started and stopped multiple times.

B.

Filters results to situations where Splunk was started and stopped once.

C.

Filters results to situations where Splunk was stopped and then immediately restarted.

D.

Filters results to situations where Splunk was started, but not stopped.

Buy Now
Questions 42

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Options:

A.

Increasing the search factor in the cluster.

B.

Increasing the replication factor in the cluster.

C.

Increasing the number of search heads in the cluster.

D.

Increasing the number of CPUs on the indexers in the cluster.

Buy Now
Questions 43

Which two sections can be expanded using the Search Job Inspector?

Options:

A.

Execution costs.

B.

Saved search history.

C.

Search job properties.

D.

Optimization suggestions.

Buy Now
Questions 44

To expand the search head cluster by adding a new member, node2, what first step is required?

Options:

A.

splunk bootstrap shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

B.

splunk init shcluster-config -master_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

C.

splunk init shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

D.

splunk add shcluster-member -new_member_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

Buy Now
Questions 45

When planning a search head cluster, which of the following is true?

Options:

A.

All search heads must use the same operating system.

B.

All search heads must be members of the cluster (no standalone search heads).

C.

The search head captain must be assigned to the largest search head in the cluster.

D.

All indexers must belong to the underlying indexer cluster (no standalone indexers).

Buy Now
Questions 46

Which command is used for thawing the archive bucket?

Options:

A.

Splunk collect

B.

Splunk convert

C.

Splunk rebuild

D.

Splunk dbinspect

Buy Now
Questions 47

What is the algorithm used to determine captaincy in a Splunk search head cluster?

Options:

A.

Raft distributed consensus.

B.

Rapt distributed consensus.

C.

Rift distributed consensus.

D.

Round-robin distribution consensus.

Buy Now
Questions 48

In splunkd. log events written to the _internal index, which field identifies the specific log channel?

Options:

A.

component

B.

source

C.

sourcetype

D.

channel

Buy Now
Exam Code: SPLK-2002
Exam Name: Splunk Enterprise Certified Architect
Last Update: Mar 23, 2024
Questions: 160
$64  $159.99
$48  $119.99
$40  $99.99
buy now SPLK-2002