SPLK-2002 Practice Test 4 — 25 Questions

Question 1

You notice that your indexer cluster has buckets in a 'Searchable' state but some are marked as 'Streaming'. What does this indicate?

Accepted Answer

Bucket replication is in progress to other peers. Streaming buckets are typically related to the replication of data from a primary to a secondary node; if they stay in this state, it may indicate replication lag.

Answer

The bucket is corrupt

Answer

The indexer is performing a hot-to-warm rollover

Answer

The data is being archived to cold storage

Question 2

Which THREE conditions must be met for an indexer to be successfully added to an Indexer Cluster?

Accepted Answer

The indexer must have network connectivity to the CM. The indexer needs the same pass4SymmKey, network access to the CM, and to be in an uninitialized state.

Answer

The indexer must be running on the same OS version as the CM

Answer

The indexer must be designated as a search head

Question 3

Which TWO types of storage can be used for indexer data?

Accepted Answer

Object storage (SmartStore). Splunk supports local storage and network storage (NAS/SAN) or object storage for SmartStore.

Answer

USB flash drives

Answer

Search head cache

Answer

Temporary memory storage

Question 4

What is the primary function of the 'Cluster Secret' in a Splunk Indexer Cluster?

Accepted Answer

To secure the communication between cluster nodes.. The secret acts as a shared password to ensure that only authorized peers can join the cluster and communicate with the Cluster Master.

Answer

To define the replication factor.

Answer

To authorize search head access.

Answer

To manage indexer licensing.

Answer

To encrypt data in flight.

Question 5

Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?

Accepted Answer

Service load is too high causing timeouts.. Loss of contact is often due to network issues, replication port blockage, or excessive load causing timeout.

Answer

License master is offline.

Answer

The indexer cluster is busy.

Question 6

Which TWO factors must be considered when balancing resource allocation between search and indexing?

Accepted Answer

Disk I/O contention. Balancing CPU and memory is essential, as heavy indexing can starve searches, and vice versa.

Answer

Number of forwarders

Answer

Web UI accessibility

Answer

App installation count

Question 7

When configuring a Search Head Cluster, which of the following is true regarding the 'shcluster_replication_port'?

Accepted Answer

It must be configured in server.conf.. The replication port is used by SHC members to sync configuration changes, job results, and knowledge objects, and must be open on all members.

Answer

It must be different for every member.

Answer

It is only used by the captain.

Answer

It is used for forwarding data.

Answer

It is automatically detected by the Cluster Master.

Question 8

When configuring a Search Head Cluster, what is the best practice for managing the 'shcluster-bundle' directory?

Accepted Answer

Version control the bundle in a separate directory. The 'shcluster-bundle' directory should be kept in a version control system (like Git) to ensure configuration changes can be tracked and reverted.

Answer

Delete it after every deployment

Answer

Keep it in the /opt/splunk/etc/system/local directory

Answer

Automatically sync it to the Cluster Master

Question 9

In a disaster recovery scenario, which file must be restored to a new Cluster Master to ensure it recognizes the existing indexer peers?

Accepted Answer

server.conf. The 'server.conf' (containing the cluster secret and configuration) and the 'master-apps' directory are crucial for restoring a CM's knowledge of the cluster.

Answer

inputs.conf

Answer

distsearch.conf

Answer

props.conf

Answer

indexes.conf

Question 10

What is the effect of setting 'forwarder_site_failover=true' in the indexer discovery stanza?

Accepted Answer

Forwarders can failover to indexers in another site.. This setting allows forwarders to automatically switch to indexers in a different site if the local indexers are unavailable.

Answer

It mandates the use of SSL.

Answer

It increases the replication factor.

Answer

Forwarders will stop sending data if the local site is down.

Answer

The indexer discovery service is disabled.

Question 11

An administrator notices that searches are slow due to high CPU utilization on indexers. Which configuration change in limits.conf directly controls the maximum number of concurrent searches allowed on an indexer?

Accepted Answer

max_searches_per_cpu. The max_searches_per_cpu setting in limits.conf defines the maximum number of concurrent searches allowed per CPU core on an indexer.

Answer

concurrent_search_limit

Answer

base_max_searches

Answer

max_searches

Question 12

When tuning search performance, what is the 'join' command's primary drawback in terms of resource usage?

Accepted Answer

It consumes significant memory on the search head. The 'join' command forces all results to be kept in memory on the search head, which is highly inefficient and resource-heavy.

Answer

It requires data to be fully ingested before searching

Answer

It causes high disk I/O on the indexer

Answer

It disables parallel processing

Question 13

When planning a deployment, which component is required to act as the primary communication hub for managing configuration bundles in an Indexer Cluster?

Accepted Answer

Cluster Master. The Cluster Master (CM) manages the configuration bundles that are pushed to all indexer peers in the cluster.

Answer

License Master

Answer

Deployment Server

Answer

Search Head

Question 14

A new indexer is added to a cluster. How does the cluster handle the historical data that already exists on other indexers?

Accepted Answer

The cluster redistributes buckets only if necessary to meet factors. Existing data is not automatically replicated to the new node unless it is required to satisfy the replication factor or search factor settings.

Answer

The new node only receives new data

Answer

The cluster forces a reindex of all historical data

Answer

All historical data is immediately copied to the new node

Question 15

What is the recommended way to handle an indexer peer that is permanently failing in an Indexer Cluster?

Accepted Answer

Use the 'splunk offline' command on the peer.. You should use the 'splunk offline' command to gracefully remove the peer, allowing the cluster to re-replicate the missing data to other healthy peers.

Answer

Ignore the peer and wait for timeout.

Answer

Delete the indexer's data directory manually.

Answer

Update the master node configuration.

Answer

Shutdown the service without notice.

Question 16

If an Indexer Cluster is configured with site-based replication, where should the 'site' attribute be defined?

Accepted Answer

In the indexer's server.conf.. The 'site' attribute must be defined in the 'server.conf' file on every indexer peer, identifying which site the peer belongs to.

Answer

On the license master.

Answer

In the inputs.conf on the forwarders.

Answer

On the Cluster Master only.

Answer

In the search head cluster settings.

Question 17

What is the primary benefit of 'bucket rolling' in an indexer?

Accepted Answer

Allows the indexer to optimize disk I/O by isolating active writing to a single bucket. Bucket rolling moves data from the 'hot' state to 'warm', allowing the indexer to finalize the bucket and start a new hot bucket, effectively managing system resources.

Answer

Enables the indexer to bypass the parsing queue

Answer

Increases the size of the bucket for better compression

Answer

Reduces the requirement for indexes to be searchable

Question 18

To optimize search performance, which feature should be enabled to allow Splunk to pre-calculate results for specific reports?

Accepted Answer

Search acceleration. Data Model Acceleration creates summaries of data that allow for faster retrieval of specific metrics.

Answer

Summary indexing

Answer

Parallel ingestion

Answer

Indexer clustering

Question 19

You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?

Accepted Answer

Use the local/ directory for configuration files that should not be replicated. Local configurations should be placed in the 'local' directory of the application, which is ignored by the SHC replication process for cluster-wide bundles.

Answer

Move files to the var/run directory

Answer

Set the configuration to immutable in server.conf

Answer

Use the shcluster/ directory

Question 20

In a multisite indexer cluster, what does the 'site' designation in server.conf specifically control?

Accepted Answer

The replication policy and bucket placement. The site designation determines which data replication policies are applied to the bucket copies based on the physical location of the indexer.

Answer

The load balancing algorithm

Answer

The user access rights

Answer

The search head affinity