SPLK-2002 Practice Exam 3 — 20 Questions

Question 1

Which THREE conditions cause a bucket to transition from Warm to Cold?

Accepted Answer

Exceeding homePath.maxDataSizeMB. Transitions to cold happen based on the maxWarmDBCount, maxTotalDataSizeMB, or total data age limits.

Answer

Indexing service restart

Answer

Search head cluster member failure

Question 2

Which bucket state is considered read-only but still resides on high-performance storage?

Accepted Answer

Warm. Warm buckets are read-only (once closed) and reside on high-performance storage.

Answer

Frozen

Answer

Hot

Answer

Cold

Question 3

Which THREE components are part of the Splunk index directory structure?

Accepted Answer

coldPath. homePath, coldPath, and thawedPath are the main directory components.

Answer

hotPath

Answer

warmPath

Question 4

What is the purpose of the 'homePath.maxDataSizeMB' setting in indexes.conf?

Accepted Answer

Limits the total size of all hot/warm buckets in the homePath. It restricts the total size of the homePath directory, which forces bucket rotation if exceeded.

Answer

Sets the maximum size of a single hot bucket

Answer

Limits the number of buckets to 100

Answer

Sets the size limit for the cold path

Question 5

Which THREE actions can help resolve 'disk-full' status on an indexer?

Accepted Answer

Reduce frozenTimePeriodInSecs. To free disk space, you can reduce retention, increase compression, or move cold data to a larger volume.

Answer

Increase maxTotalDataSizeMB

Answer

Increase replication factor

Question 6

If you have a search head cluster and you want to accelerate a data model, where are the resulting summary files stored?

Accepted Answer

On the indexers. The accelerated summaries are stored on the indexers that contain the source data.

Answer

In the KV Store

Answer

On each search head member

Answer

On the deployer node

Question 7

A user wants to restore data from frozen buckets. What is the process for making this data searchable again?

Accepted Answer

Copy to the thawedPath and use the 'rebuild' command. The data must be thawed by copying the bucket to the thawed directory and restarting/triggering a refresh.

Answer

Directly copy files to the warm path

Answer

Change the frozenTimePeriodInSecs

Answer

Run 'splunk restore --bucket'

Question 8

Which TWO settings are crucial when planning for bucket replication in a clustered environment?

Accepted Answer

site_replication_factor. Replication factor and site replication factor are the core components of cluster bucket redundancy.

Answer

listen_port

Answer

max_hot_buckets

Answer

heartbeat_timeout

Question 9

You need to reduce the number of small buckets created in your index. Which parameter should you increase?

Accepted Answer

maxDataSize. Increasing maxDataSize increases the size of each bucket, thereby reducing the total count of buckets.

Answer

maxWarmDBCount

Answer

frozenTimePeriodInSecs

Answer

minHotBuckets

Question 10

Which THREE items should be included in an index sizing capacity plan?

Accepted Answer

Retention period (days). Capacity planning requires knowing the ingestion rate, retention requirements, and compression ratios to estimate space.

Answer

Search head version

Answer

Number of alerts configured

Question 11

Which path is used to define where Splunk stores the actual indexed data for a specific index?

Accepted Answer

homePath. homePath is the primary location for hot and warm buckets.

Answer

coldPath

Answer

frozenPath

Answer

thawedPath

Question 12

Which TWO of the following are valid ways to monitor the status of an Indexer Cluster?

Accepted Answer

Using the CLI command 'splunk show cluster-status'.. You can use the CLI 'show cluster-status' command or the monitoring console UI.

Answer

Checking the license usage logs.

Answer

Reviewing the forwarder logs.

Answer

Running a search on the indexers directly.

Question 13

How can you verify the current health and performance of your indexers using the Monitoring Console?

Accepted Answer

Indexer: Instance dashboard. The 'Indexer: Instance' dashboard provides real-time metrics on throughput, CPU, and disk usage per indexer.

Answer

License usage dashboard

Answer

Deployment Health dashboard

Answer

Search Performance dashboard

Question 14

Which THREE actions occur during the SmartStore bucket lifecycle?

Accepted Answer

Upload bucket to remote storage. SmartStore involves moving buckets to remote storage, caching locally, and evicting local copies.

Answer

Automatic daily re-indexing

Answer

Auto-increase replication factor

Question 15

Which TWO areas should be checked when troubleshooting slow data ingestion?

Accepted Answer

Parsing queue fill percentage. The parsing queue and the output queue are the two most common bottlenecks during ingestion.

Answer

License master usage

Answer

User authentication speed

Answer

Search head memory usage

Question 16

Which TWO tools in the Splunk UI assist in performance troubleshooting?

Accepted Answer

Monitoring Console. The Search Inspector and the Monitoring Console are the standard tools for performance diagnosis.

Answer

Deployment Server

Answer

License Master

Answer

Upload Data Wizard

Question 17

Which component in Splunk is required to be the central point for managing licenses in a clustered environment?

Accepted Answer

The License Master. The License Master (LM) is the central authority for all license entitlements in a cluster.

Answer

The Deployment Server

Answer

The Search Head

Answer

The Cluster Master

Question 18

You want to perform a rolling restart of an Indexer Cluster without stopping ingestion. What configuration ensures that indexers remain available?

Accepted Answer

Set 'restart_mode=rolling'.. The rolling restart mechanism automatically manages peer availability, but you should also ensure your forwarders are configured with indexing-side load balancing.

Answer

Disable the indexer peers.

Answer

Stop the Cluster Master first.

Answer

Restart all indexers at once.

Answer

Set 'replication_factor=1'.

Question 19

When a Search Head Cluster is running in a multi-site environment, what configuration ensures search results are optimized?

Accepted Answer

Search affinity settings in server.conf.. Configuring 'site' in server.conf on each SHC member allows the cluster to use search affinity to query the nearest indexers.

Answer

Index-level bucket settings.

Answer

Disabling search head replication.

Answer

Site-specific replication factor.

Answer

Increasing the search timeout.

Question 20

What is the primary function of the 'Cluster Master' in an Indexer Cluster?

Accepted Answer

To manage the indexer cluster's configuration and bucket state. The CM coordinates the cluster, including bucket replication, managing peers, and distributing configuration.

Answer

To handle incoming data from universal forwarders

Answer

To serve the Splunk user interface

Answer

To search across all indexers