Be able to configure indexes.conf retention and rollover, explain bucket lifecycle and SmartStore cache eviction, and size buckets for search efficiency. The critical point: frozenTimePeriodInSecs governs deletion, and evicted SmartStore buckets stay in remote storage.
Start practicing
Data Lifecycle Management — choose a session length
Free · No account required
Domain overview
Data Lifecycle Management covers how Splunk Enterprise stores, ages, and deletes indexed data across indexer clusters. Questions test bucket lifecycle stages (hot/warm/cold/frozen/thawed), retention and rollover settings in indexes. conf, SmartStore remote storage and cache eviction, and sizing decisions that control bucket counts and searchability.
Exam objectives
Bucket lifecycle stages and how rolling from hot to warm to cold to frozen is triggered
indexes.conf retention settings including frozenTimePeriodInSecs and maxTotalDataSizeMB
SmartStore remote storage requirements and local cache eviction behavior for clustered indexers
Rollover parameters such as maxDataSize and their effect on bucket count and search performance
Assuming frozen data is deleted automatically; frozenTimePeriodInSecs must be set or data can persist indefinitely.
Confusing maxDataSize rollover with retention; increasing it reduces bucket count but does not control how long data is kept.
Believing SmartStore eviction deletes remote buckets; eviction only removes the local cached copy while remote data remains.
Click any question to see the full explanation and answer options, or start a focused practice session above.
A Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio. If the raw data volume doubles, how should the retention period be modified to maintain the original storage footprint?
2An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?
3What happens to data when a bucket's 'frozenTimePeriodInSecs' is reached?
4A Splunk architect is performing capacity planning. If an indexer receives 1TB of logs daily, and the Splunk compression factor is 1:10 (resulting in 100GB of storage per day), how much storage is needed for 30 days of data, including a 20% overhead for bucket overhead and metadata?
5An indexer cluster is suffering from 'bucket repair' loops. What is the most likely cause related to the bucket lifecycle?
6Which metric is the best predictor of the storage needed for an indexer in a cluster?
7What is the purpose of the 'homePath.maxDataSizeMB' setting in indexes.conf?
8In a SmartStore architecture, what happens when a bucket is evicted from local cache?
9A user wants to restore data from frozen buckets. What is the process for making this data searchable again?
10Which configuration file and stanza are used to define the bucket lifecycle policy for a custom index named 'customer_data'?
11You need to reduce the number of small buckets created in your index. Which parameter should you increase?
12An architect is designing an index lifecycle for compliance. The requirement is to keep data for exactly 7 years. Which setting must be configured to prevent premature deletion?
13Which THREE factors influence the disk I/O performance of an indexer cluster?
14What is the primary architectural trade-off when using very short 'maxHotSpanSecs' values?
15Which THREE components are part of the Splunk index directory structure?
16Which TWO of these factors determine when a bucket rolls from hot to warm?
17Which TWO types of storage can be used for indexer data?
18A Splunk architect is configuring a new index called `netflow` that must retain data for exactly 90 days, then delete it automatically. The index will receive high volume and is expected to grow significantly. Which setting in `indexes.conf` should the architect use to enforce this retention period, ensuring that buckets are removed from the index after 90 days?
19An architect is configuring a Splunk indexer cluster with SmartStore. The remote storage is an S3 bucket. To ensure data integrity and availability, the architect must configure the cluster to use a remote storage that supports which feature?
Be able to configure indexes.conf retention and rollover, explain bucket lifecycle and SmartStore cache eviction, and size buckets for search efficiency. The critical point: frozenTimePeriodInSecs governs deletion, and evicted SmartStore buckets stay in remote storage.
The Courseiva SPLK-2002 question bank contains 19 questions in the Data Lifecycle Management domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Data Lifecycle Management domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included