Splunk · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When planning a deployment, which component is required to act as the primary communication hub for managing configuration bundles in an Indexer Cluster?
Cluster Master
The CM is responsible for distributing configuration bundles to peers.
License Master
Deployment Server
Search Head
You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?
Use the local/ directory for configuration files that should not be replicated
The local directory is specifically ignored by the SHC replication mechanism.
Move files to the var/run directory
Set the configuration to immutable in server.conf
Use the shcluster/ directory
A Search Head Cluster (SHC) is experiencing frequent 'captain election' issues during high-load periods. Upon reviewing the logs, you notice network latency spikes between nodes. Which parameter in the SHC configuration should be adjusted to allow for more tolerance in node communication?
heartbeat_timeout
This is the primary setting to handle transient network issues in SHC.
election_timeout
replication_factor
search_timeout
When implementing a multisite indexer cluster, what happens if the cluster master becomes unreachable for a short duration?
All indexing stops immediately
Search heads stop returning results
Data replication across sites is forced immediately
Indexer peers continue to accept and index data
Peers maintain local autonomy for data ingestion during CM downtime.
You are designing an Indexer Cluster with three sites. To ensure data availability during a site failure, you have configured multisite replication. Which setting must be explicitly defined in server.conf on the cluster master to ensure that buckets are replicated across sites according to your policy?
replication_factor
multisite_replication_factor
This setting defines the specific bucket replication requirements for multisite deployments.
site_replication_policy
cluster_replication_mode
When configuring a Search Head Cluster, what is the purpose of the 'deployer'?
To coordinate the election of the captain
To manage the replication of search configurations
The deployer pushes configuration updates to all SHC members.
To act as a load balancer for users
To store the search results for the cluster
Want more Deployment Architecture And Clustering practice?
Practice this domainA Splunk administrator needs to identify why a specific search is experiencing high 'Disk Read' wait times. Which tool or log source should be utilized to correlate search IDs with specific disk latency metrics?
Search Inspector
Audit logs correlated with indexer metrics via the Monitoring Console
The Monitoring Console provides the best integrated view for this correlation.
Splunk Web UI Performance Monitor
splunkd.log
When managing indexer clustering, what is the impact of a high 'replication_factor' on indexing performance?
Allows for faster data ingestion without resource constraints
Improves search speed by reducing data density
Increases indexing latency due to synchronous replication requirements
Writes must wait for acknowledgment from secondary nodes, increasing latency.
Decreases indexer storage requirements
Which dashboard in the Monitoring Console provides the best overview of resource consumption per search head?
Search Head Activity
Correct, this is the designated dashboard for search head performance.
Data Ingestion Performance
Resource Usage: Forwarders
Indexer Activity
Which setting in indexes.conf should be tuned to balance memory usage and indexing speed for a high-volume indexer?
maxDataSize
Controls the size of buckets, affecting merge frequency.
hot_bucket_count
io_priority
block_size
You are analyzing search performance using the Search Activity dashboard. You observe that 'Result Count' is extremely high for a specific saved search. Which optimization technique is most effective to reduce the load on the indexer?
Increase the memory allocation for the search head
Disable data model acceleration for the index
Use the | table command at the start
Use specific time ranges and selective filters at the beginning of the search
Filtering early reduces the total data processed by the search pipeline.
An administrator notices that searches are slow due to high CPU utilization on indexers. Which configuration change in limits.conf directly controls the maximum number of concurrent searches allowed on an indexer?
concurrent_search_limit
max_searches_per_cpu
Correct, this is the primary setting for limiting concurrent searches.
base_max_searches
max_searches
Want more Performance Tuning practice?
Practice this domainA Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio. If the raw data volume doubles, how should the retention period be modified to maintain the original storage footprint?
Decrease retention to 15 days
Halving the retention offsets the doubling of the daily ingestion volume.
Keep retention at 30 days
Decrease retention to 7 days
Increase retention to 60 days
A Splunk architect notices that Data Model Acceleration summaries are consuming excessive disk space. Which configuration setting in datamodels.conf should be adjusted to limit the storage impact of these summaries?
acceleration.earliest_time
acceleration.backfill
acceleration.max_time
This limits how far back in time the summary is kept on disk.
acceleration.cron_schedule
A large-scale Splunk deployment is experiencing 'bucket rolling' latency. Upon investigation, you determine that the indexer is waiting for the indexer cluster manager to acknowledge the bucket status. Which indexer clustering setting directly impacts the speed of bucket replication during the rolling process?
search_factor
max_replication_streams
Increasing max_replication_streams allows more concurrent bucket replications, reducing rolling latency.
service_interval
heartbeat_timeout
In a multisite indexer cluster, a bucket with replication factor 3 has its primary copy in Site 1 and secondary copies in Site 2. A network partition occurs. Which setting determines if the indexer will accept new data if it cannot reach the Site 2 indexers?
min_replication_factor
search_factor_per_site
cluster_replication_queue
site_replication_factor
This dictates the policy for site-based replication requirements.
When designing an index strategy for high-frequency search performance, which component of the bucket lifecycle has the highest impact on disk I/O performance?
Hot/Warm buckets
Hot/Warm buckets are the active write and primary search targets.
Summary buckets
Cold buckets
Frozen buckets
An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?
A local RAID 10 array
An S3-compatible object store
SmartStore relies on S3-compatible APIs for object storage interaction.
A network-attached storage (NAS) with NFS v4
A SAN with Fibre Channel connectivity
Want more Data Lifecycle Management practice?
Practice this domainIn an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?
Directing search requests to specific indexers.
Indexing incoming forwarder data.
Maintaining the bucket registry and managing replication status.
The CM maintains the state of the cluster and delegates replication tasks.
Storing raw data and serving search requests.
Aggregating search results from indexers.
If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?
5
2
The search factor dictates the count of searchable bucket copies.
4
1
3
A customer is experiencing 'Search peer [peer-name] is not responding' errors during indexer maintenance. Which configuration parameter in server.conf should be tuned to prevent search failures during rolling restarts?
peer_down_timeout
max_search_time
restart_timeout
This allows for longer wait times during planned maintenance.
heartbeat_timeout
search_retry_timeout
Which component in a distributed search environment is responsible for the 'Search Affinity' feature?
Search Head
The Search Head uses the site information to determine which indexers to query.
Deployment Server
License Master
Indexer Peer
Cluster Master
When using a Search Head Cluster, what is the purpose of the 'captain'?
To act as the Cluster Master for indexers.
To store all bucket data for the indexers.
To receive data from forwarders.
To distribute search results to the end user.
To coordinate search scheduling and replicate configuration bundles.
The captain is the elected leader responsible for cluster management tasks.
What happens to a search job if the Search Head Cluster captain goes down during an active search?
The search head cluster becomes read-only.
Indexers stop processing data.
A new captain is elected and search jobs are recovered.
The RAFT algorithm handles captain election and job recovery.
The entire cluster must be restarted.
The search job is canceled immediately.
Want more High Availability And Distributed Search practice?
Practice this domainYou need to perform a clean upgrade of an indexer in a cluster. You place the indexer into maintenance mode. What happens to the replication and search factor during this time?
Bucket fix-up activities are suspended for this peer
Maintenance mode ignores the offline status of the peer for fix-up purposes.
The Master initiates bucket re-replication immediately
The search factor is lowered to zero
Search queries are routed to other peers
You are troubleshooting a clustered indexer environment where buckets are stuck in a 'streaming' state. Which log file on the indexer peer should you examine to determine why the replication is failing?
metrics.log
replication_data.log
This log specifically captures the replication stream traffic and potential failures.
cluster_master.log
splunkd.log
You are performing a maintenance task on a Search Head Cluster (SHC). You need to ensure the Captain is not currently running any scheduled reports before you decommission it. Where do you check this?
Search Head Clustering: Status dashboard
This dashboard shows current captain status and any active jobs.
Monitoring Console: Search: Activity dashboard
The 'distsearch.conf' file
The 'savedsearches.conf' file
You notice that the Monitoring Console (MC) reports a 'Disk usage' warning for an indexer. Which dashboard should you navigate to in order to identify which specific index is consuming the most disk space?
Indexes and Volumes: Instance
This dashboard provides a detailed breakdown of index usage by volume and disk size.
Indexing Performance: Instance
Resource Usage: Indexer Instance
Cluster Status
You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?
Indexer Cluster: Status
This provides a comprehensive view of bucket replication and peer status.
Indexing Performance: Cluster
Resource Usage: Indexer Cluster
Distributed Search: Status
An Indexer Cluster is experiencing 'Search Factor' violations. Which component is responsible for orchestrating the fix-up process to restore the search factor?
The Cluster Master
The Cluster Master manages bucket distribution and replication policies.
The Indexer Peer containing the missing copies
The Search Head
The Deployment Server
Want more Troubleshooting And Operations practice?
Practice this domainThe SPLK-2002 exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Deployment Architecture And Clustering, Performance Tuning, Data Lifecycle Management, High Availability And Distributed Search, Troubleshooting And Operations. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-2002 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.