SPLK-2002 Practice Test 2 — 25 Questions

Question 1

To optimize search performance, which feature should be enabled to allow Splunk to pre-calculate results for specific reports?

Accepted Answer

Search acceleration. Search acceleration (also called report acceleration) uses precomputed summaries stored in the index to speed up searches that match a saved report's base search. When enabled on a saved report, Splunk builds and maintains summary data so subsequent runs of that report or similar searches return results much faster. This is the feature specifically designed to pre-calculate results for reports.

Answer

Summary indexing

Answer

Parallel ingestion

Answer

Indexer clustering

Question 2

Which Splunk process is responsible for managing the indexer's disk I/O and bucket lifecycle?

Accepted Answer

splunkd. splunkd is the main Splunk daemon process that runs on all Splunk instances, including indexers, and is responsible for managing indexing, search, and various background tasks such as disk I/O and bucket lifecycle management. It handles the rolling of buckets from hot to warm to cold to frozen, as well as disk space monitoring.

Answer

mongod

Answer

python

Answer

kvstore

Question 3

What is the impact of having too many small buckets in an index?

Accepted Answer

Degraded search performance due to high overhead. Having too many small buckets in an index degrades search performance because each bucket must be opened and processed separately, leading to high overhead in terms of file handles, memory, and search initialization. Splunk searches across many small buckets require more resources and time compared to fewer, larger buckets. This is a common issue when buckets are rolled frequently due to small size limits.

Answer

Faster data rolling

Answer

Reduced disk space usage

Answer

Improved search performance

Question 4

You need to reduce the number of small buckets created in your index. Which parameter should you increase?

Accepted Answer

maxDataSize. The maxDataSize parameter in indexes.conf controls the maximum size of a hot bucket before it rolls to warm. Increasing maxDataSize allows each bucket to hold more data, which reduces the total number of buckets created for a given volume of ingested data. This directly addresses the goal of reducing small buckets.

Answer

maxWarmDBCount

Answer

frozenTimePeriodInSecs

Answer

minHotBuckets

Question 5

You are monitoring indexer performance. Which metric in the Monitoring Console's 'Indexing Performance' dashboard best indicates a bottleneck in the ingestion pipeline?

Accepted Answer

Average Queue Fill Percentage. The Average Queue Fill Percentage metric in the Indexing Performance dashboard directly measures how full the indexing pipeline queues are. A persistently high or rising queue fill percentage indicates that events are arriving faster than the indexers can process them, which is the clearest signal of an ingestion bottleneck. Disk, memory, and CPU metrics can be symptoms, but queue fill is the direct indicator of pipeline backpressure.

Answer

Disk Read IOPS

Answer

Memory Usage

Answer

CPU Usage

Question 6

In an indexer cluster, what happens if the cluster master is permanently lost and you do not have a backup of the 'master-apps' directory?

Accepted Answer

You will be unable to distribute new configuration updates. The cluster master stores cluster-wide configuration in $SPLUNK_HOME/etc/master-apps, which is bundled and pushed to peers via the configuration replication mechanism. If the master is lost without a backup of master-apps, you can rebuild a master and rejoin peers, but the custom configurations (indexes, props, transforms, etc.) that were only on the master are gone, so you cannot distribute new or updated configuration bundles. Data itself resides on the peers and is not lost, and peers continue serving searches with their last-received configuration.

Answer

The data is permanently lost

Answer

The indexers continue to work normally indefinitely

Answer

You can restore the configuration from the peer nodes

Question 7

Which tool is best for monitoring the health and performance of the entire Splunk environment?

Accepted Answer

Monitoring Console. The Monitoring Console (formerly known as the Distributed Management Console) is Splunk's built-in tool specifically designed to monitor the health, performance, and topology of an entire Splunk deployment. It provides dashboards for indexing, search, resource usage, and license usage across all components. It is the recommended tool for holistic environment monitoring.

Answer

Splunk CLI

Answer

Deployment Server

Answer

Splunk Web UI

Question 8

What must be installed on all Search Head Cluster members before they can join the cluster?

Accepted Answer

The same security key. All Search Head Cluster members must share the same security key (also called the cluster key or passphrase) to authenticate and join the cluster. This key is set via the `splunk edit shcluster-config -secret` command or in `server.conf` under `[shclustering]` with the `pass4SymmKey` setting. Without an identical key, members cannot establish trust and will fail to form the cluster.

Answer

A shared SSL certificate

Answer

A dedicated storage partition

Answer

A specialized Splunk App

Question 9

When adding a new indexer to a multisite cluster, which attribute must be correctly set in the configuration before joining the cluster?

Accepted Answer

The site assignment. In a multisite indexer cluster, each indexer must be assigned to a site (site0, site1, etc.) via the 'site' attribute in server.conf under the [general] stanza or in the clustering stanza. This site assignment determines replication and search affinity behavior, so it must be correctly set before the indexer joins the cluster.

Answer

The indexer's role

Answer

The license server path

Answer

The search head affinity index

Question 10

You manage a Splunk indexer cluster with three peer nodes, a cluster manager, and a search head. The search head is configured with the cluster manager's URI in its server.conf under [clustering]. A new compliance requirement mandates that all searchable data copies must remain on the original peer that indexed the data, and replication to other peers is strictly prohibited. What should you do to meet this requirement while keeping the cluster functional?

Accepted Answer

Disable indexer clustering and revert the peers to standalone indexers, then configure the search head to query each indexer directly.. Indexer clustering is designed to replicate buckets across peers for fault tolerance and search efficiency. It does not support a mode where buckets are permanently pinned to their originating peer. The only way to meet a strict data locality requirement is to avoid clustering altogether and use standalone indexers with distributed search, ensuring that each indexer only stores and serves its own data.

Answer

Configure the search head to use only the originating peer for searches by setting search_factor to 0 and disabling replication.

Answer

Set replication_factor to 1 in the cluster manager's server.conf under [clustering] and push the configuration to all peers.

Answer

Set the cluster manager to maintenance mode and manually assign buckets to peers using the splunk CLI bucket command.

Question 11

You are investigating a scenario where search performance has degraded. You observe that many searches are hitting the 'warm' buckets but not the 'cold' buckets. Where should you look to verify bucket rotation policies?

Accepted Answer

indexes.conf. Bucket rotation policies — including the thresholds that move buckets from hot to warm to cold to frozen, and the retention periods for each — are defined per index in indexes.conf. Parameters like maxHotBuckets, maxWarmDBCount, frozenTimePeriodInSecs, and homePath/coldPath control when and where buckets roll. To verify or change rotation behavior, you inspect indexes.conf on the indexers (or via the cluster manager for clustered environments).

Answer

outputs.conf

Answer

inputs.conf

Answer

server.conf

Question 12

Which of the following is a key advantage of using a Search Head Cluster over a single search head?

Accepted Answer

High availability of search and user interface. A Search Head Cluster (SHC) provides high availability and horizontal scaling for search and UI workloads: if one member fails, others continue serving searches, and users can be load-balanced across members. The captain coordinates configuration replication and artifact replication, but the core benefit is resilience and capacity for search, not indexing. Indexing is handled by indexers, not search heads, so SHC does not improve indexing performance.

Answer

Faster indexing performance

Answer

Reduced license costs

Answer

Smaller storage footprint

Question 13

A Splunk architect notices that an indexer cluster's search head is returning incomplete results for a search spanning the last 7 days. The Monitoring Console shows that several buckets are missing their searchable copies, and the cluster master reports a search factor (SF) of 2 but replication factor (RF) of 3. Which of the following best explains why the search results are incomplete and what should be done to remediate the issue?

Accepted Answer

The indexer cluster is under-replicated; wait for automatic fix-up or manually trigger fix-up to create additional searchable copies to meet the search factor.. In an indexer cluster, the search factor determines how many searchable copies of each bucket are maintained. When searchable copies are missing, searches may not see all data because the search head can only search buckets that are searchable on the indexers. The cluster master orchestrates fix-up to create additional copies, but if fix-up is not progressing, manual intervention may be required. Addressing the searchable copy deficit directly resolves the incomplete search results.

Answer

The indexer cluster's replication factor is set higher than the number of indexers; reduce RF to match the number of indexers and restart the cluster.

Answer

The search head is not configured to use the cluster master for search; configure the search head to point to the cluster master and restart Splunk.

Answer

The search head is experiencing a network partition; verify connectivity between the search head and all indexers, and restart the search head.

Question 14

An architect is troubleshooting a Splunk deployment where search head cluster members are unable to replicate the search head captain's knowledge bundle. The captain's log shows repeated errors about failing to push the bundle to a member. Which of the following is the most likely cause and the appropriate resolution?

Accepted Answer

The captain's management port (default 8089) is blocked by a firewall between the captain and the members; open the port to allow bundle replication.. In a search head cluster, the captain is responsible for replicating the knowledge bundle to all members. This replication occurs over the management port (8089 by default). If a firewall blocks this port between the captain and a member, the captain cannot push the bundle, leading to replication errors. Ensuring the management port is open and accessible on all members resolves the issue. This is a common configuration oversight in environments with strict network policies.

Answer

The search head cluster members are using a different Splunk version than the captain; upgrade all members to match the captain's version.

Answer

The search head cluster members have insufficient disk space to store the knowledge bundle; free up disk space on the members.

Answer

The captain's replication factor for the knowledge bundle is set to 0; increase the replication factor to at least 1.

Question 15

An architect is configuring a Splunk indexer cluster with SmartStore. The remote storage is an S3 bucket. To ensure data integrity and availability, the architect must configure the cluster to use a remote storage that supports which feature?

Accepted Answer

Strong read-after-write consistency. SmartStore relies on strong read-after-write consistency to ensure that uploaded buckets are immediately visible to all indexers. This guarantees that searches access the most recent data and prevents inconsistencies, making it a fundamental requirement for remote storage backends.

Answer

Cross-region replication

Answer

Server-side encryption

Answer

Object versioning

Question 16

You want to move an indexer peer to a different site in an existing multisite cluster. What is the procedure to ensure the cluster recognizes the new site mapping?

Accepted Answer

Change the site value in server.conf and restart the indexer. To move a peer to a different site, you change the site value in the [general] stanza of server.conf on that peer and restart Splunk. On restart, the peer re-registers with the cluster master and reports its new site, and the master updates its site mapping accordingly. No rebalance or re-add is required for the site change itself, though a rebalance may be desired afterward to redistribute bucket copies.

Answer

Run a rebalance command on the CM

Answer

Delete the indexer and re-add it

Answer

Modify the indexer's hostname

Question 17

Which TWO performance-related tasks should be performed on a regular basis?

Accepted Answer

Reviewing the Search Activity dashboard. Option A is correct because reviewing the Search Activity dashboard on a regular basis reveals search performance metrics such as search concurrency, runtimes, and skipped or queued searches, allowing administrators to identify and address performance degradation proactively. Option E is correct because monitoring index storage usage regularly helps prevent indexes from reaching disk capacity limits, which would cause indexing to pause or searches to fail, and it supports capacity planning and retention policy tuning. Option B is not appropriate because deleting all historical data is destructive and unnecessary; retention should be managed through configured policies, not wholesale deletion. Option C is wrong because restarting indexers daily is disruptive and does not improve performance; indexers should only be restarted for maintenance or troubleshooting. Option D is incorrect because license capacity is a purchased entitlement that cannot and should not be increased daily as a performance task.

Answer

Deleting all historical data

Answer

Restarting all indexers daily

Answer

Increasing license capacity daily

Question 18

Which dashboard in the Monitoring Console provides the best overview of resource consumption per search head?

Accepted Answer

Search Head Activity. The Search Head Activity dashboard in the Monitoring Console provides the best overview of resource consumption per search head, showing metrics such as CPU usage, memory, disk I/O, and search load broken down by search head. It is designed specifically to help admins identify which search heads are under heavy load and to balance search distribution. Other dashboards focus on different tiers (indexers, forwarders) or different concerns (ingestion performance).

Answer

Data Ingestion Performance

Answer

Resource Usage: Forwarders

Answer

Indexer Activity

Question 19

Which THREE of the following are risks if the replication_factor is too low?

Accepted Answer

Data loss if an indexer fails.. In Splunk indexer clustering, replication_factor determines how many copies of each bucket are maintained across peer nodes, so setting it too low directly creates availability and durability risks. Option B is correct because with a low replication_factor there are fewer bucket copies than needed to tolerate failures, so if an indexer (peer) holding a copy fails, buckets can be lost or go missing until recovered. Option C is correct because the search factor (number of searchable copies) can never exceed the replication_factor; if replication_factor is set below the desired search factor, the cluster cannot meet its search factor requirements. Option D is correct because with minimal replicas, taking a peer offline for maintenance removes a copy and can push buckets below the replication factor, causing degraded search availability and longer downtime while the cluster re-replicates or recovers. Option A is not correct because indexing speed is not directly governed by replication_factor in this way, and Option E is not correct because the cluster manager's CPU usage is not a defined risk of a low replication_factor.

Answer

Slower indexing speed.

Answer

Higher CPU usage on the CM.

Question 20

You are tasked with upgrading an Indexer Cluster. Which order of operations is recommended by Splunk best practices?

Accepted Answer

Upgrade the Cluster Master first, then the indexer peers. Splunk best practices recommend upgrading the Cluster Master first, then the indexer peers. This is because the Cluster Master must be running a version that is compatible with the peers, and it manages the upgrade process. After the master is upgraded, peers can be upgraded in a rolling fashion to maintain cluster availability.

Answer

Upgrade the search heads first

Answer

Upgrade all components simultaneously

Answer

Upgrade the indexer peers first, then the Cluster Master