SPLK-2002 Practice Test 2 — 10 Questions

Question 1

In an Indexer Cluster, which component stores the 'bucket' index files?

Accepted Answer

Indexer Peer. In a Splunk Indexer Cluster, the indexer peers are the nodes that actually receive, index, and store the raw data in the form of buckets. Buckets are directories containing rawdata, index files, and metadata, and they reside on the indexer peers' filesystems. The cluster master coordinates replication and searchability, but it does not store the bucket files themselves.

Answer

Search Head

Answer

Cluster Master

Answer

Deployment Server

Question 2

You are using the Monitoring Console to view the 'Search Head Clustering: Status' dashboard. You see that one of the nodes is showing as 'Missing'. What does this status imply?

Accepted Answer

The captain has not received a heartbeat from the node. In the Search Head Clustering: Status dashboard, a node showing 'Missing' means the cluster captain has not received a heartbeat from that node within the expected interval. The captain tracks member health via heartbeats, and a missing heartbeat indicates the node is unreachable, down, or partitioned from the cluster. This is a connectivity/health signal, not a performance or licensing state.

Answer

The node is overloaded

Answer

The node is in maintenance mode

Answer

The node has an invalid license

Question 3

You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?

Accepted Answer

Indexer Cluster: Status. The Monitoring Console's 'Indexer Cluster: Status' dashboard is purpose-built to show a high-level health view of all indexer cluster nodes, including peer status, replication and search factor compliance, and bucket replication status. It aggregates cluster health so you can quickly see whether the cluster is fully replicated and whether any peers are down or lagging. The other dashboards focus on performance, resource usage, or distributed search rather than cluster replication health.

Answer

Indexing Performance: Cluster

Answer

Resource Usage: Indexer Cluster

Answer

Distributed Search: Status

Question 4

You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?

Accepted Answer

Search affinity. Search affinity is the Search Head Cluster feature that keeps a search on a search head located in the same site as the indexers holding the data, minimizing cross-site traffic. When search affinity is enabled, the SHC captain assigns searches to members based on the site of the indexers that own the relevant buckets. This is distinct from indexer discovery or site-aware routing, which operate at the indexer/forwarder layer rather than the search head layer.

Answer

Site-aware routing

Answer

Data locality

Answer

Load balancing

Question 5

A user claims that a search is not returning data from a specific time range. You suspect the data has been rolled to cold storage and the cold storage is not being searched. Which configuration file controls which cold paths are included in the search?

Accepted Answer

indexes.conf. The indexes.conf file defines index properties, including the paths for hot, warm, cold, and frozen buckets. The 'coldPath' setting specifies where cold buckets are stored, and Splunk searches these paths by default unless configured otherwise. Therefore, indexes.conf controls which cold paths are included in searches.

Answer

distsearch.conf

Answer

server.conf

Answer

limits.conf

Question 6

In an indexer cluster, why might you use the 'splunk list cluster-peers' command?

Accepted Answer

To verify the synchronization status of all indexer peers. The 'splunk list cluster-peers' command queries the cluster master and returns the status of all peer nodes, including whether each peer is Up, Down, or in a degraded state, along with its replication and searchability status. It is the standard CLI tool for verifying peer synchronization and health in an indexer cluster. It does not modify cluster state; it is read-only diagnostic output.

Answer

To remove a node from the cluster

Answer

To update the license configuration

Answer

To force a cluster rebalance

Question 7

You notice that the Monitoring Console (MC) reports a 'Disk usage' warning for an indexer. Which dashboard should you navigate to in order to identify which specific index is consuming the most disk space?

Accepted Answer

Indexes and Volumes: Instance. The Monitoring Console's 'Indexes and Volumes: Instance' dashboard shows per-index disk usage on a specific indexer instance, including the size of each index and its volumes. This is the correct dashboard to identify which index is consuming the most disk space when a Disk usage warning fires. It breaks down usage by index, making the culprit immediately visible.

Answer

Indexing Performance: Instance

Answer

Resource Usage: Indexer Instance

Answer

Cluster Status

Question 8

Which configuration file is used to specify the disk path where index buckets are stored?

Accepted Answer

indexes.conf. The indexes.conf file is the central configuration file for defining and managing indexes in Splunk. Within each index stanza, the 'homePath' setting specifies the directory where the index's hot and warm buckets are stored, and 'coldPath' specifies where cold buckets are stored. Therefore, indexes.conf is the correct file to specify the disk path for index buckets.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 9

When implementing a multisite indexer cluster, what happens if the cluster master becomes unreachable for a short duration?

Accepted Answer

Indexer peers continue to accept and index data. In a multisite indexer cluster, if the cluster master becomes unreachable for a short duration, indexer peers continue to accept and index data. The master is responsible for coordinating replication and search affinity, but peers can operate independently for a period. Indexing does not stop immediately, and search heads can still return results from available peers. Replication across sites is not forced immediately; it continues based on existing policies.

Answer

All indexing stops immediately

Answer

Search heads stop returning results

Answer

Data replication across sites is forced immediately

Question 10

In a SmartStore architecture, what happens when a bucket is evicted from local cache?

Accepted Answer

The local disk space is freed. In SmartStore, buckets are cached locally on indexers for search performance, but when the cache fills, the cache manager evicts buckets back to remote storage (S3, Azure Blob, GCS). Eviction frees the local disk space occupied by that bucket's data, allowing new buckets to be cached. The bucket remains fully searchable because it can be re-fetched from remote storage on demand.

Answer

The bucket is moved to the cold path

Answer

The bucket is no longer searchable

Answer

The bucket is deleted from remote storage