Splunk · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When planning a deployment, which component is required to act as the primary communication hub for managing configuration bundles in an Indexer Cluster?
Cluster Master
The Cluster Master distributes configuration bundles to peer nodes and coordinates the cluster's replication and search factors. It is the central management and communication hub, distinct from indexers that store data and search heads that handle queries.
License Master
Deployment Server
Search Head
You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?
Use the local/ directory for configuration files that should not be replicated
The local directory is specifically ignored by the SHC replication mechanism.
Move files to the var/run directory
Set the configuration to immutable in server.conf
Use the shcluster/ directory
When implementing a multisite indexer cluster, what happens if the cluster master becomes unreachable for a short duration?
All indexing stops immediately
Search heads stop returning results
Data replication across sites is forced immediately
Indexer peers continue to accept and index data
Indexer peers hold replicated buckets and continue indexing incoming data independently; the master only coordinates replication and search head functions. A brief master outage therefore does not halt ingestion, satisfying the scenario's short-duration unreachability constraint.
Which component in an Indexer Cluster is responsible for assigning buckets to peers?
The Search Head
The indexer peer itself
The Deployment Server
The Cluster Master
The Cluster Master (now manager) coordinates the indexer cluster: it controls bucket replication and search factor, and tells peers which buckets to hold. This satisfies the stem's requirement for the component that assigns buckets, not the peers or search heads themselves.
You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?
Site-aware routing
Data locality
Load balancing
Search affinity
Search affinity routes searches to indexers in the same site as the search head, reducing cross-site traffic and latency. This satisfies the requirement to prioritise same-site searches. Other features, such as search head clustering replication or indexer discovery, address availability and distribution, not site-based prioritisation.
What is the primary function of the 'search_factor' in an indexer cluster?
The number of searchable copies of each bucket
The search_factor sets how many searchable copies of each bucket the cluster maintains, separate from the replication_factor that governs total copies. Raising it increases search capacity and resilience, satisfying the stem's requirement to define searchable replica count across peer nodes.
The maximum number of concurrent searches
The number of indexer peers in the cluster
The number of search heads allowed in the cluster
Want more Deployment Architecture And Clustering practice?
Practice this domainWhen managing indexer clustering, what is the impact of a high 'replication_factor' on indexing performance?
Allows for faster data ingestion without resource constraints
Improves search speed by reducing data density
Increases indexing latency due to synchronous replication requirements
A higher replication_factor forces each bucket to be copied to more peer indexers synchronously before indexing is acknowledged, so latency rises. This satisfies the stem's constraint that replication is synchronous, directly increasing indexing latency rather than throughput.
Decreases indexer storage requirements
Which dashboard in the Monitoring Console provides the best overview of resource consumption per search head?
Search Head Activity
Search Head Activity reports per-search-head resource usage, including CPU, memory and disk consumption, letting you compare load across the search head tier. It directly satisfies the stem's requirement for a per-search-head view of resource consumption rather than cluster-wide or indexer-focused metrics.
Data Ingestion Performance
Resource Usage: Forwarders
Indexer Activity
You are analyzing search performance using the Search Activity dashboard. You observe that 'Result Count' is extremely high for a specific saved search. Which optimization technique is most effective to reduce the load on the indexer?
Increase the memory allocation for the search head
Disable data model acceleration for the index
Use the | table command at the start
Use specific time ranges and selective filters at the beginning of the search
Applying specific time ranges and selective filters first reduces the volume of events retrieved from the indexers before the search pipeline runs. This directly addresses the high Result Count by shrinking the scanned dataset, cutting indexer load far more effectively than later-stage tuning.
A user complains that a search is slow despite having a small time range. The Search Inspector reveals 'event_count' is high, but 'scanned_count' is also high. What is the likely cause?
The indexer has too much memory
Data model acceleration is failing
The search is not using an indexed field to filter data
A high scanned_count alongside high event_count means Splunk read far more raw data than the time range alone implies, because the filter is not an indexed field. Without an indexed term narrowing the search at index time, Splunk must scan and filter events at search time, slowing results.
The search head is underpowered
In a multi-site indexer cluster, which setting controls the number of copies of data kept per site?
site_replication_factor
site_replication_factor defines the per-site copy count in a multi-site indexer cluster, expressed as a comma-separated list matching each site's label. It satisfies the stem's constraint of controlling copies kept per site, unlike replication_factor, which governs total cluster-wide copies regardless of site boundaries.
max_site_copies
site_data_count
cross_site_replication
Which command helps you understand if your search is retrieving too much data from the disk by analyzing the 'index_time' and 'search_time'?
Monitoring Console Search Activity Dashboard
Search Inspector
Search Inspector breaks down a search's execution into phases, exposing index_time and search_time per operator. High search_time relative to index_time reveals excessive disk retrieval, directly satisfying the stem's requirement to diagnose whether too much data is being read from disk.
btool
splunkd log analysis
Want more Performance Tuning practice?
Practice this domainA Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio. If the raw data volume doubles, how should the retention period be modified to maintain the original storage footprint?
Decrease retention to 15 days
Doubling raw volume while keeping the same storage footprint requires halving the retention period, since compressed storage scales linearly with daily ingest. Reducing 30 days to 15 days exactly offsets the doubled daily volume at the unchanged 50% compression ratio, preserving the original total index size.
Keep retention at 30 days
Decrease retention to 7 days
Increase retention to 60 days
An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?
A local RAID 10 array
An S3-compatible object store
SmartStore caches bucket data locally while ageing cold buckets to remote storage, so the backend must expose an S3-compatible API; native S3, GCS or Azure Blob via gateway all qualify. This satisfies the stem's requirement for a remote object store rather than block or file storage.
A network-attached storage (NAS) with NFS v4
A SAN with Fibre Channel connectivity
What happens to data when a bucket's 'frozenTimePeriodInSecs' is reached?
It is moved back to the hot bucket state
It is re-indexed for better performance
It is moved to the warm bucket state
It is deleted or moved to a cold storage directory
When frozenTimePeriodInSecs elapses, the bucket rolls past the frozen state; Splunk then deletes it, or moves it to the cold storage path if coldToFrozenDir is configured. This satisfies the stem's condition that the bucket's frozen time period has been reached.
A Splunk architect is performing capacity planning. If an indexer receives 1TB of logs daily, and the Splunk compression factor is 1:10 (resulting in 100GB of storage per day), how much storage is needed for 30 days of data, including a 20% overhead for bucket overhead and metadata?
3.6 TB
100GB daily compressed data over 30 days gives 3TB, then the 20% overhead for bucket metadata raises this to 3.6TB. This satisfies the stem's requirement to include overhead alongside the 1:10 compression factor, yielding the correct total storage capacity for the indexer.
1.2 TB
3.0 TB
4.2 TB
An indexer cluster is suffering from 'bucket repair' loops. What is the most likely cause related to the bucket lifecycle?
Insufficient replication factor
Bucket corruption preventing indexer recovery
Corrupted bucket files halt the indexer's replication and searchability recovery, so the cluster repeatedly attempts to repair the same buckets, producing repair loops. The lifecycle constraint is that buckets must reach a searchable, replicated state; persistent corruption prevents that transition, driving endless repair cycles.
Excessive search concurrency
Misconfigured cold path
Which metric is the best predictor of the storage needed for an indexer in a cluster?
Number of forwarders
Search concurrency
Number of users
Daily ingestion volume
Daily ingestion volume directly determines how much raw data lands in the index each day, and Splunk's compression and retention policies scale from that figure. It is the primary input for sizing calculations, whereas licence usage, user counts or search concurrency affect performance rather than storage capacity.
Want more Data Lifecycle Management practice?
Practice this domainIn an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?
Directing search requests to specific indexers.
Indexing incoming forwarder data.
Maintaining the bucket registry and managing replication status.
The Cluster Master coordinates bucket replication across peer indexers, tracking which buckets exist, their searchable and replicated states, and triggering fixes when copies fall short. This registry function is what maintains the replication factor the cluster promises.
Storing raw data and serving search requests.
Aggregating search results from indexers.
If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?
5
2
The search_factor of 2 directly determines how many searchable copies of each bucket the cluster maintains, satisfying the stem's stated search_factor constraint. Replication_factor governs total copies (3), not searchable ones, so it is irrelevant here. Microsoft Entra ID plays no role in Splunk indexer replication.
4
1
3
When using a Search Head Cluster, what is the purpose of the 'captain'?
To act as the Cluster Master for indexers.
To store all bucket data for the indexers.
To receive data from forwarders.
To distribute search results to the end user.
To coordinate search scheduling and replicate configuration bundles.
The captain is the elected Search Head Cluster member that runs the scheduler and replicates configuration bundles to peers, satisfying the stem's coordination requirement. This centralises search artefact distribution while other members handle user searches, with re-election on failure.
What happens to a search job if the Search Head Cluster captain goes down during an active search?
The search head cluster becomes read-only.
Indexers stop processing data.
A new captain is elected and search jobs are recovered.
Search Head Cluster members maintain replicated search artefacts and the captain role is elected dynamically. When the captain fails, a new captain is elected and in-flight search jobs are recovered from replicated state, so searches continue rather than being lost.
The entire cluster must be restarted.
The search job is canceled immediately.
You notice that your indexer cluster has 'Streaming' buckets that are not yet searchable. What is the most likely cause?
The indexer is in maintenance mode.
The indexer disk is full.
The license is expired.
The search factor is not met for these buckets.
Streaming buckets hold replicated raw data that becomes searchable only once the search factor is satisfied, meaning enough searchable copies exist across peer nodes. Until that replication completes, the bucket remains non-searchable, so an unmet search factor is the cause.
The Cluster Master is down.
Which command is used to check the health of an Indexer Cluster from the Cluster Master CLI?
splunk cluster-check
splunk show cluster-status
Running splunk show cluster-status on the Cluster Master returns cluster health, including replication and search factor status and peer availability. This directly satisfies the stem's constraint of checking Indexer Cluster health from the Cluster Master CLI rather than the monitoring console.
splunk inspect-cluster
splunk search-peers
splunk list indexers
Want more High Availability And Distributed Search practice?
Practice this domainYou notice that the Monitoring Console (MC) reports a 'Disk usage' warning for an indexer. Which dashboard should you navigate to in order to identify which specific index is consuming the most disk space?
Indexes and Volumes: Instance
The Indexes and Volumes: Instance dashboard breaks down disk consumption per index on a specific indexer, letting you pinpoint the largest consumer. This directly satisfies the need to identify which index is driving the disk usage warning.
Indexing Performance: Instance
Resource Usage: Indexer Instance
Cluster Status
You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?
Indexer Cluster: Status
The Indexer Cluster: Status dashboard in the Monitoring Console aggregates peer node health, replication and search factor status, and bucket replication across all indexers. It provides the high-level cluster-wide overview the task requires, unlike per-node or per-index dashboards.
Indexing Performance: Cluster
Resource Usage: Indexer Cluster
Distributed Search: Status
An Indexer Cluster is experiencing 'Search Factor' violations. Which component is responsible for orchestrating the fix-up process to restore the search factor?
The Cluster Master
The Cluster Master (manager node) coordinates peer replication and orchestrates fix-up when a bucket's searchable copies fall below the Search Factor. It identifies which peer should receive the missing searchable copy and triggers the copy, restoring the Search Factor. Indexers hold the data but do not orchestrate this remediation themselves.
The Indexer Peer containing the missing copies
The Search Head
The Deployment Server
You have added a new indexer to a cluster. The indexer is up, but the Cluster Master does not show it as 'Ready'. What is the most likely cause?
The indexer is missing the license file
The cluster master is in maintenance mode
The security key on the indexer does not match the Cluster Master
Cluster Master readiness requires every peer to share the identical cluster security key; a mismatched key prevents the indexer from authenticating and joining the cluster, so it never transitions to Ready despite the service running.
The indexer has not indexed any data yet
A user reports that they cannot see data from an indexer peer in the Monitoring Console. Which service should you check first to ensure the MC is able to communicate with the remote instance?
splunkweb
mongod
Deployment Client
splunkd
The Monitoring Console communicates with indexer peers through splunkd, which handles inter-instance data and management traffic on the relevant ports. If splunkd is not running or reachable on the remote instance, the MC cannot retrieve that peer's data, so it is checked first.
A Search Head Cluster is experiencing frequent 'Search Head Captain Election' messages in the logs. What is the most likely cause?
The indexer cluster is offline
The KV store is running
Network latency or instability between SHC members
Captain elections trigger when members cannot exchange heartbeats reliably. Network latency or instability between search head cluster members causes missed heartbeats, forcing repeated elections. Stable, low-latency connectivity is required for the captain to maintain leadership.
The license is expired
Want more Troubleshooting And Operations practice?
Practice this domainThe SPLK-2002 exam has 85 questions and must be completed in 90 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Deployment Architecture And Clustering, Performance Tuning, Data Lifecycle Management, High Availability And Distributed Search, Troubleshooting And Operations. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-2002 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.