Be able to read cluster health with splunk show cluster-status and the manager REST endpoints, and explain bucket types and fixup. The single most important thing: know how replication_factor and search_factor differ and what each guarantees about data availability and searchability.
Start practicing
High Availability And Distributed Search — choose a session length
Free · No account required
Domain overview
This domain covers indexer clustering and search head clustering in Splunk Enterprise: replication and search factors, bucket lifecycle and fixup, captain election, cluster monitoring endpoints, and distributed search behavior. Questions test whether you can reason about failure modes, data availability, and the CLI/REST tools used to inspect cluster health.
Exam objectives
Indexer cluster monitoring via splunk show cluster-status, the manager's /services/cluster/manager endpoints, and the monitoring console
Bucket types and lifecycle: hot, warm, cold, frozen, and their searchability and replication states
Search head cluster captain election, member heartbeats, and causes of members losing contact with the captain
Consequences of low replication_factor and search_factor on data availability, searchability, and primary copy placement
Confusing replication_factor with search_factor: replication governs copies of buckets across peers, search_factor governs how many peers must host searchable copies
Assuming a hot bucket is replicated immediately; hot buckets are searchable but replication of a bucket completes when it rolls to warm
Treating the cluster manager as a search peer or captain; it coordinates replication and bucket fixup but does not serve search results
Click any question to see the full explanation and answer options, or start a focused practice session above.
In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?
2If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?
3When using a Search Head Cluster, what is the purpose of the 'captain'?
4What happens to a search job if the Search Head Cluster captain goes down during an active search?
5You notice that your indexer cluster has 'Streaming' buckets that are not yet searchable. What is the most likely cause?
6Which command is used to check the health of an Indexer Cluster from the Cluster Master CLI?
7When configuring search affinity for a multi-site cluster, what is the behavior if no indexers are available in the local site?
8What is the recommended method to distribute configuration changes across a Search Head Cluster?
9What is the recommended way to handle an indexer peer that is permanently failing in an Indexer Cluster?
10When adding a new indexer to an existing Indexer Cluster, what is the best practice to ensure the indexer is ready before it starts receiving data?
11Which type of bucket is used for the most recent data and is generally searchable?
12Which component is responsible for distributing configuration bundles to indexers in a cluster?
13What is the effect of setting 'forwarder_site_failover=true' in the indexer discovery stanza?
14When using a load balancer in front of a search head cluster, why is session affinity (sticky sessions) recommended?
15What is the primary function of the 'Cluster Secret' in a Splunk Indexer Cluster?
16Which TWO of the following are features of the Indexer Cluster Master?
17Which TWO of the following are valid ways to monitor the status of an Indexer Cluster?
18Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?
19Which THREE of the following are key components of a disaster recovery plan for Splunk?
20Which THREE of the following are risks if the replication_factor is too low?
21A Splunk architect is designing a Search Head Cluster (SHC) with five members. The customer requires that searches continue to run even if the captain is unavailable. Which of the following best describes the captain election process and the impact on search activity?
22A Splunk architect is deploying an Indexer Cluster with site awareness. The cluster has three sites: site1, site2, and site3. The replication factor is 3, and the search factor is 2. The architect wants to ensure that searchable copies are distributed across sites for high availability. Which of the following configurations should be applied?
Be able to read cluster health with splunk show cluster-status and the manager REST endpoints, and explain bucket types and fixup. The single most important thing: know how replication_factor and search_factor differ and what each guarantees about data availability and searchability.
The Courseiva SPLK-2002 question bank contains 22 questions in the High Availability And Distributed Search domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the High Availability And Distributed Search domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included