Be able to pick the right Monitoring Console dashboard or CLI command for a symptom and read its output correctly. The most important thing is interpreting replication and search factor status, and knowing which config file governs cold bucket searchability.
Start practicing
Troubleshooting And Operations — choose a session length
Free · No account required
Domain overview
This domain covers operating and diagnosing Splunk deployments: indexer clusters, search head clusters, KV store, and the Monitoring Console. Questions are scenario-based, asking which dashboard, CLI command, or configuration file reveals a given symptom, and how to interpret statuses like Missing, degraded replication, or unsearched cold buckets.
Exam objectives
Using Monitoring Console dashboards such as Indexer Clustering and Search Head Clustering status views
Running CLI checks like splunk show kvstore-status and cluster status commands
Interpreting replication, search factor, and bucket fixup states across peer nodes
Locating settings in indexes.conf and related configs controlling cold storage and searchability
Confusing a search head cluster node reported as Missing with one that is merely down or restarting
Assuming cold buckets are searched by default when the relevant index setting disables it
Checking cluster health only via the Manager node UI and ignoring per-peer replication status
Click any question to see the full explanation and answer options, or start a focused practice session above.
You notice that the Monitoring Console (MC) reports a 'Disk usage' warning for an indexer. Which dashboard should you navigate to in order to identify which specific index is consuming the most disk space?
2You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?
3An Indexer Cluster is experiencing 'Search Factor' violations. Which component is responsible for orchestrating the fix-up process to restore the search factor?
4You have added a new indexer to a cluster. The indexer is up, but the Cluster Master does not show it as 'Ready'. What is the most likely cause?
5A user reports that they cannot see data from an indexer peer in the Monitoring Console. Which service should you check first to ensure the MC is able to communicate with the remote instance?
6A Search Head Cluster is experiencing frequent 'Search Head Captain Election' messages in the logs. What is the most likely cause?
7You are investigating a scenario where search performance has degraded. You observe that many searches are hitting the 'warm' buckets but not the 'cold' buckets. Where should you look to verify bucket rotation policies?
8You are troubleshooting a KV store issue in an Indexer Cluster. Which command allows you to verify the status of the KV store and its replication on a node?
9You are monitoring indexer performance. Which metric in the Monitoring Console's 'Indexing Performance' dashboard best indicates a bottleneck in the ingestion pipeline?
10When upgrading a cluster, you have successfully upgraded the Master. Now you are moving to the Indexer Peers. What is the recommended order for upgrading the peers?
11You notice that your indexers are using different versions of a lookup file. Where should you look to find the authoritative version of the lookup file if it is being managed by the Cluster Master?
12A user claims that a search is not returning data from a specific time range. You suspect the data has been rolled to cold storage and the cold storage is not being searched. Which configuration file controls which cold paths are included in the search?
13You are using the Monitoring Console to view the 'Search Head Clustering: Status' dashboard. You see that one of the nodes is showing as 'Missing'. What does this status imply?
14You are troubleshooting a slow indexer cluster. You identify that the 'replication_port' is experiencing high latency. Where is the replication port defined?
15You are troubleshooting a configuration bundle replication issue in an Indexer Cluster. The peers are not receiving the latest configuration from the Master. What is the first thing you should check on the Cluster Master?
16You are troubleshooting slow search performance across the indexer cluster. Which THREE of the following could be potential causes?
17When planning a Splunk upgrade, which THREE of the following actions are considered best practices for maintaining system health?
18You are investigating why an indexer node is not reporting to the Cluster Master. Which THREE of the following are the most likely causes?
19You have determined that a specific app deployed via the Deployment Server is causing indexer errors. Which THREE of the following actions can you take to rectify this?
20An Indexer Cluster is in 'Maintenance Mode'. Which THREE of the following implications must be considered during this time?
21A Splunk architect notices that an indexer cluster's search head is returning incomplete results for a search spanning the last 7 days. The Monitoring Console shows that several buckets are missing their searchable copies, and the cluster master reports a search factor (SF) of 2 but replication factor (RF) of 3. Which of the following best explains why the search results are incomplete and what should be done to remediate the issue?
22An architect is troubleshooting a Splunk deployment where search head cluster members are unable to replicate the search head captain's knowledge bundle. The captain's log shows repeated errors about failing to push the bundle to a member. Which of the following is the most likely cause and the appropriate resolution?
23An indexer cluster has a replication factor of 3 and a search factor of 2. The Monitoring Console shows several buckets in the cluster with a search factor of 1. You need to confirm whether the cluster manager is actively fixing these buckets. Which command should you run on the cluster manager to view the status of bucket fixup tasks?
24A deployment server manages a large number of universal forwarders. Several forwarders in a server class named `linux_web` have stopped receiving configuration updates after you modified a `props.conf` file in the deployment app. You need to determine why the deployment server is not pushing the updated configuration to those forwarders. Which log file on the deployment server should you examine first?
25You are using the Monitoring Console to monitor a distributed Splunk Enterprise environment. A dashboard that previously showed data for all indexers now displays 'No results found' for several panels. You have confirmed that the indexers are up and forwarding data. Which action should you take first to restore the Monitoring Console's visibility into those indexers?
Be able to pick the right Monitoring Console dashboard or CLI command for a symptom and read its output correctly. The most important thing is interpreting replication and search factor status, and knowing which config file governs cold bucket searchability.
The Courseiva SPLK-2002 question bank contains 25 questions in the Troubleshooting And Operations domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Troubleshooting And Operations domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included