SPLK-1003 Indexes And Data Management Practice Test 2 — 15 Questions

Question 1

What is the effect of setting 'maxHotSpanSecs' to a very low value?

Accepted Answer

More frequent bucket rolling.. A low maxHotSpanSecs value causes buckets to roll more frequently, which increases the number of buckets and overhead.

Answer

Increased search performance.

Answer

Decreased disk usage.

Answer

Faster ingestion.

Question 2

Which Splunk GUI page provides a summary of all configured indexes and their current disk usage?

Accepted Answer

Settings > Data > Indexes. The 'Indexes' page under Settings > Data > Indexes provides a dashboard-style view of index status and usage.

Answer

Settings > Server Settings

Answer

Settings > Data > Inputs

Answer

Settings > Licensing

Question 3

What command is used to check the health and integrity of an index bucket?

Accepted Answer

splunk fsck. The 'splunk fsck' command is designed to perform file system checks on buckets.

Answer

splunk status

Answer

splunk check

Answer

splunk validate

Question 4

When should you use the 'volume' configuration in indexes.conf?

Accepted Answer

To manage shared storage limits across multiple indexes.. Volumes are used to group multiple indexes together to manage their shared storage capacity constraints.

Answer

To increase search speed.

Answer

To replicate data between indexers.

Answer

To encrypt index data.

Question 5

If a search head cluster member cannot access an indexer's bucket, what should you verify first?

Accepted Answer

The replication status and indexer clustering state.. Bucket access in a cluster is often related to the replication factor and the status of the bucket on the indexer peers.

Answer

The indexer's license status.

Answer

The OS version of the search head.

Answer

The search head's RAM.

Question 6

What is the default retention policy for the '_internal' index?

Accepted Answer

30 days. The internal index has specific default retention settings to ensure system logs are kept for troubleshooting.

Answer

Unlimited

Answer

90 days

Answer

1 day

Question 7

How can you increase the amount of raw data stored in a single bucket before it rolls?

Accepted Answer

Modify 'maxDataSize'.. The 'maxDataSize' setting dictates the size threshold for rolling a bucket from hot to warm.

Answer

Modify 'maxTotalDataSizeMB'.

Answer

Modify 'frozenTimePeriodInSecs'.

Answer

Modify 'homePath'.

Question 8

An administrator finds that search performance for a specific index is slow. What should they check regarding index buckets?

Accepted Answer

The number of buckets and their individual sizes.. If buckets are too large or fragmented (too many small buckets), search performance suffers due to high IOPS or excessive file handles.

Answer

The operating system's kernel version.

Answer

The indexer's CPU count.

Answer

The license master's time synchronization.

Question 9

You need to modify the retention of a specific index without affecting others. Where should you make this change in a distributed environment?

Accepted Answer

On the Indexer via the Deployment Server.. You should use the configuration management tool (like the Deployment Server or Cluster Master) to push the indexes.conf change to the indexers.

Answer

In the local.meta file.

Answer

In the web UI on the License Master.

Answer

On the Search Head.

Question 10

Which TWO factors contribute to the 'frozen' state of a bucket?

Accepted Answer

The bucket age exceeds frozenTimePeriodInSecs.. Buckets move to frozen when they exceed the time-based retention policy or the maximum total size limit.

Answer

The bucket is locked by a search head.

Answer

The index reaches maxHotBuckets.

Answer

The license master is unreachable.

Question 11

Which THREE types of bucket states exist in a healthy Splunk indexer?

Accepted Answer

Warm. Hot, Warm, and Cold are the standard active states for data buckets in an index.

Answer

Evaporated

Answer

Simmer

Question 12

Which TWO settings are required to enable cold-to-frozen archiving?

Accepted Answer

coldToFrozenDir. To enable archiving, you must define the coldToFrozenScript and ensure the path for frozen data exists.

Answer

frozenPath

Answer

maxFrozenSize

Answer

enableArchive = true

Question 13

Which TWO settings in indexes.conf are used to control the rotation of hot buckets?

Accepted Answer

maxHotSpanSecs. maxDataSize and maxHotSpanSecs are the two primary parameters that determine when a bucket should roll from hot to warm.

Answer

frozenTimePeriodInSecs

Answer

maxTotalDataSizeMB

Answer

coldPath

Question 14

Which TWO actions should be taken before manually moving an index to a new storage volume?

Accepted Answer

Verify the file system permissions of the new path.. You must stop the Splunk service and ensure the filesystem permissions are correct for the new directory.

Answer

Modify the indexes.conf file.

Answer

Clear the license master cache.

Answer

Delete the existing index.

Question 15

Which THREE pieces of information can be obtained using the 'splunk fsck' command?

Accepted Answer

Time range of events in a bucket.. fsck is used to repair buckets, check for integrity, and view bucket-level metadata like event counts and time ranges.

Answer

The current user's role.

Answer

Network latency to the indexer.