SPLK-2002 Practice Test 10 — 10 Questions

Question 1

When adding a new indexer to an existing Indexer Cluster, what is the best practice to ensure the indexer is ready before it starts receiving data?

Accepted Answer

Start the splunk service and wait for the CM to acknowledge registration.. When adding a new indexer to an existing cluster, the correct procedure is to install and configure the indexer with the cluster master's address and the peer replication/search ports, then start the splunkd service and wait for the CM to acknowledge the peer's registration. Only after the CM registers the peer and begins streaming the cluster bundle and replicating buckets should the indexer be considered ready to receive data. This ensures the peer has the correct configuration and bucket state before participating in search and replication.

Answer

Set the indexer to maintenance mode.

Answer

Manually copy index buckets from other peers.

Answer

Restart all existing peers.

Answer

Add the indexer to the indexer discovery list.

Question 2

You are troubleshooting a Search Head Cluster where a member node cannot join the cluster. Which log file on the node is the most useful for diagnosing the communication issue?

Accepted Answer

splunkd.log. splunkd.log is the primary log for the Splunk daemon (splunkd), which handles all core processes including cluster communication, replication, and configuration. When a Search Head Cluster member fails to join, the issue is almost always related to the cluster manager connection, replication ports, or configuration bundle application—all of which are logged in splunkd.log. This log contains detailed error messages about cluster membership, heartbeats, and REST API calls that are essential for diagnosing communication failures.

Answer

web_access.log

Answer

audit.log

Answer

metrics.log

Question 3

Which TWO tools in the Splunk UI assist in performance troubleshooting?

Accepted Answer

Monitoring Console. The Monitoring Console (A) is correct because it is Splunk's dedicated UI for health and performance monitoring, providing dashboards for resource usage, indexing throughput, search performance, and component-level diagnostics across the deployment. The Search Inspector (C) is correct because it appears in the Search app's Job menu and exposes detailed per-search performance data such as run duration, execution costs, search phases, and resource usage, which is essential for troubleshooting slow or inefficient searches. The Deployment Server (B) is incorrect because it is used to distribute apps and configuration to forwarders and clients, not to diagnose performance. The License Master (D) is incorrect because it manages license usage and violations, which is a licensing concern rather than a performance-troubleshooting tool. The Upload Data Wizard (E) is incorrect because it is used to ingest or onboard data, not to analyze or troubleshoot performance.

Answer

Deployment Server

Answer

License Master

Answer

Upload Data Wizard

Question 4

You have determined that a specific app deployed via the Deployment Server is causing indexer errors. Which THREE of the following actions can you take to rectify this?

Accepted Answer

Disable the server class associated with that app. Option A is correct because disabling the server class in the Deployment Server stops the deployment of the problematic app to the indexers, preventing further errors while you investigate. Option C is correct because removing the app folder from $SPLUNK_HOME/etc/deployment-apps on the Deployment Server removes it from the deployment payload, so it will no longer be pushed to clients. Option E is correct because replacing the app in the deployment-apps directory with a known stable version lets the Deployment Server distribute a corrected app, resolving the errors. Option B is not correct because restarting the master node (cluster manager) does not address the app causing indexer errors and is unrelated to deployment remediation. Option D is not correct because manually deleting the app folder on indexer peers is not a supported or persistent fix; the Deployment Server will simply redeploy the app on the next phone-home unless the server class or app is changed.

Answer

Restart the master node

Answer

Manually delete the app folder on all indexer peers

Question 5

You notice that your indexers are using different versions of a lookup file. Where should you look to find the authoritative version of the lookup file if it is being managed by the Cluster Master?

Accepted Answer

$SPLUNK_HOME/etc/master-apps. When the Cluster Master manages indexer configuration via a cluster bundle, the authoritative source is $SPLUNK_HOME/etc/master-apps on the Cluster Master. Apps and lookups placed here are packaged into the cluster bundle and pushed to all peers. The master-apps directory is the staging area for the master's bundle.

Answer

$SPLUNK_HOME/etc/slave-apps

Answer

$SPLUNK_HOME/etc/system/local

Answer

$SPLUNK_HOME/etc/apps

Question 6

A Splunk architect is performing capacity planning. If an indexer receives 1TB of logs daily, and the Splunk compression factor is 1:10 (resulting in 100GB of storage per day), how much storage is needed for 30 days of data, including a 20% overhead for bucket overhead and metadata?

Accepted Answer

3.6 TB. The daily raw ingest is 1TB, which compresses at 1:10 to 100GB of on-disk storage per day. Over 30 days that is 100GB × 30 = 3TB of compressed data. Adding the 20% overhead for bucket metadata and index structures yields 3TB × 1.2 = 3.6TB, matching option A.

Answer

1.2 TB

Answer

3.0 TB

Answer

4.2 TB

Question 7

What is the recommended method to distribute configuration changes across a Search Head Cluster?

Accepted Answer

Using the 'splunk apply shcluster-bundle' command.. The recommended method to distribute configuration changes across a Search Head Cluster is to use the 'splunk apply shcluster-bundle' command from the deployer. This command pushes the configuration bundle to all members, ensuring consistency and leveraging the cluster's built-in replication and restart mechanisms.

Answer

Using the Deployment Server.

Answer

Updating the captain only.

Answer

Manual file copying to each node.

Answer

Using a shared network drive.

Question 8

When planning a deployment, which component is required to act as the primary communication hub for managing configuration bundles in an Indexer Cluster?

Accepted Answer

Cluster Master. The Cluster Master (now called Cluster Manager in newer versions) is the central coordination point for an indexer cluster. It manages the replication and search factors, distributes configuration bundles to peer nodes, and coordinates bucket replication and fixup. It is the required primary communication hub for configuration bundle management in an indexer cluster.

Answer

License Master

Answer

Deployment Server

Answer

Search Head

Question 9

When a search is running, what does the 'Dispatch' directory store?

Accepted Answer

Temporary search results and metadata. The Dispatch directory ($SPLUNK_HOME/var/run/splunk/dispatch) is where the search head writes per-search artifacts while a search job is active: the search results (results.csv.gz), the job's metadata (info.csv), the search.log, and any intermediate map/reduce output. It is transient working storage tied to the search job lifecycle, not persistent indexed data. Once the job's TTL expires (default 10 minutes for completed jobs, configurable via dispatch.ttl in limits.conf), the directory is removed.

Answer

Indexed data

Answer

License information

Answer

App configuration files

Question 10

What happens to data when a bucket's 'frozenTimePeriodInSecs' is reached?

Accepted Answer

It is deleted or moved to a cold storage directory. When a bucket reaches its frozenTimePeriodInSecs, Splunk considers the data frozen. Depending on the index's frozenTimePeriodInSecs and coldToFrozenDir or coldToFrozenScript settings, the bucket is either deleted or archived to a cold storage directory. This is the final stage of the bucket lifecycle.

Answer

It is moved back to the hot bucket state

Answer

It is re-indexed for better performance

Answer

It is moved to the warm bucket state