SPLK-2002 Practice Test 2 — 10 Questions

Question 1

Which metric is the best predictor of the storage needed for an indexer in a cluster?

Accepted Answer

Daily ingestion volume. Daily ingestion volume is the primary driver for capacity planning.

Answer

Number of forwarders

Answer

Search concurrency

Answer

Number of users

Question 2

A Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio. If the raw data volume doubles, how should the retention period be modified to maintain the original storage footprint?

Accepted Answer

Decrease retention to 15 days. If volume doubles (1000GB/day) and storage space must remain constant, the retention must be halved (15 days) to keep the total stored data volume equivalent.

Answer

Keep retention at 30 days

Answer

Decrease retention to 7 days

Answer

Increase retention to 60 days

Question 3

Which configuration file and stanza are used to define the bucket lifecycle policy for a custom index named 'customer_data'?

Accepted Answer

indexes.conf [customer_data]. indexes.conf is the standard file where index-specific lifecycle settings are defined.

Answer

datamodels.conf [customer_data]

Answer

server.conf [customer_data]

Answer

inputs.conf [customer_data]

Question 4

A Splunk architect is performing capacity planning. If an indexer receives 1TB of logs daily, and the Splunk compression factor is 1:10 (resulting in 100GB of storage per day), how much storage is needed for 30 days of data, including a 20% overhead for bucket overhead and metadata?

Accepted Answer

3.6 TB. 100GB * 30 days = 3000GB. 3000GB * 1.20 = 3600GB or 3.6TB.

Answer

1.2 TB

Answer

3.0 TB

Answer

4.2 TB

Question 5

An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?

Accepted Answer

An S3-compatible object store. SmartStore requires S3-compatible object storage (AWS S3, Google Cloud Storage, or Azure Blob Storage).

Answer

A local RAID 10 array

Answer

A network-attached storage (NAS) with NFS v4

Answer

A SAN with Fibre Channel connectivity

Question 6

A large-scale Splunk deployment is experiencing 'bucket rolling' latency. Upon investigation, you determine that the indexer is waiting for the indexer cluster manager to acknowledge the bucket status. Which indexer clustering setting directly impacts the speed of bucket replication during the rolling process?

Accepted Answer

max_replication_streams. replication_factor impacts the number of copies, but the throughput of bucket replication is managed by the replication queue settings.

Answer

search_factor

Answer

service_interval

Answer

heartbeat_timeout

Question 7

Which THREE factors influence the disk I/O performance of an indexer cluster?

Accepted Answer

Search concurrency. Disk I/O is impacted by ingestion rate, search concurrency, and the type of storage used (e.g., SSD vs HDD).

Answer

Deployment server latency

Answer

Number of users logged in

Question 8

Which component in a distributed search environment is responsible for the 'Search Affinity' feature?

Accepted Answer

Search Head. Search affinity allows a Search Head to prefer indexers within the same site, reducing cross-site bandwidth usage.

Answer

Deployment Server

Answer

License Master

Answer

Indexer Peer

Answer

Cluster Master

Question 9

When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?

Accepted Answer

To define the number of copies of search artifacts. In an SHC, the replication_factor defines how many copies of the search-related configurations are replicated across members.

Answer

To limit the number of users

Answer

To specify the number of search nodes in the cluster

Answer

To balance the search load across nodes

Question 10

If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?

Accepted Answer

2. The search factor determines how many copies of a bucket are searchable. If search_factor is 2, the cluster ensures at least two copies are available for searching.

Answer

5

Answer

4

Answer

1

Answer

3