SPLK-2002 Practice Test 2 — 30 Questions

Question 1

A user complains that a search is slow despite having a small time range. The Search Inspector reveals 'event_count' is high, but 'scanned_count' is also high. What is the likely cause?

Accepted Answer

The search is not using an indexed field to filter data. If the scanned count is much higher than the event count, the search is reading too much data from disk because it is not effectively filtering by indexed fields (e.g., using terms that are not indexed).

Answer

The indexer has too much memory

Answer

Data model acceleration is failing

Answer

The search head is underpowered

Question 2

A search head cluster is currently running in a degraded state because the 'captain' has failed. What is the expected behavior?

Accepted Answer

A new captain is elected automatically. In an SHC, if the captain fails, the remaining members will automatically perform an election to choose a new captain, allowing the cluster to continue operating.

Answer

The cluster stops processing all searches

Answer

The cluster automatically reverts to standalone mode

Answer

Manual intervention is required to elect a new captain

Question 3

In a multisite indexer cluster, a bucket with replication factor 3 has its primary copy in Site 1 and secondary copies in Site 2. A network partition occurs. Which setting determines if the indexer will accept new data if it cannot reach the Site 2 indexers?

Accepted Answer

site_replication_factor. site_replication_factor determines the behavior for bucket replication across sites.

Answer

min_replication_factor

Answer

search_factor_per_site

Answer

cluster_replication_queue

Question 4

What is the consequence of setting 'maxDataSize' to 'auto_high_volume' for an index?

Accepted Answer

It sets the bucket size to 10GB. auto_high_volume creates 10GB buckets to reduce the number of buckets, which is beneficial for large indexing volumes.

Answer

It disables data compression

Answer

It automatically enables bucket replication

Answer

It forces buckets to roll every 1 hour

Question 5

In a SmartStore architecture, what happens when a bucket is evicted from local cache?

Accepted Answer

The local disk space is freed. In SmartStore, eviction removes the copy from the indexer's local disk, but the bucket persists in remote object storage.

Answer

The bucket is moved to the cold path

Answer

The bucket is no longer searchable

Answer

The bucket is deleted from remote storage

Question 6

What is the primary architectural trade-off when using very short 'maxHotSpanSecs' values?

Accepted Answer

Increased metadata overhead on the indexer. Frequent bucket rotation leads to a higher number of buckets, which increases indexer overhead and metadata management.

Answer

Improved data ingestion speed

Answer

Reduced search performance

Answer

Increased compression efficiency

Question 7

A Splunk architect notices that Data Model Acceleration summaries are consuming excessive disk space. Which configuration setting in datamodels.conf should be adjusted to limit the storage impact of these summaries?

Accepted Answer

acceleration.max_time. acceleration.max_time defines the retention period for the accelerated summaries.

Answer

acceleration.earliest_time

Answer

acceleration.backfill

Answer

acceleration.cron_schedule

Question 8

Which TWO of the following are true about Indexer Discovery?

Accepted Answer

It dynamically provides a list of indexers to forwarders.. Indexer discovery simplifies management by allowing forwarders to dynamically find indexers without manual config updates.

Answer

It is used for SHC members to find indexers.

Answer

It must be configured on every forwarder.

Answer

It replaces the load balancer.

Question 9

When designing an index strategy for high-frequency search performance, which component of the bucket lifecycle has the highest impact on disk I/O performance?

Accepted Answer

Hot/Warm buckets. Hot/Warm buckets are actively written to and searched, placing the highest load on the storage subsystem.

Answer

Summary buckets

Answer

Cold buckets

Answer

Frozen buckets

Question 10

What happens to data when a bucket's 'frozenTimePeriodInSecs' is reached?

Accepted Answer

It is deleted or moved to a cold storage directory. Once the frozen time period is reached, the bucket is frozen (moved to the frozen path or deleted).

Answer

It is moved back to the hot bucket state

Answer

It is re-indexed for better performance

Answer

It is moved to the warm bucket state

Question 11

Which THREE conditions cause a bucket to transition from Warm to Cold?

Accepted Answer

Exceeding homePath.maxDataSizeMB. Transitions to cold happen based on the maxWarmDBCount, maxTotalDataSizeMB, or total data age limits.

Answer

Indexing service restart

Answer

Search head cluster member failure

Question 12

Which bucket state is considered read-only but still resides on high-performance storage?

Accepted Answer

Warm. Warm buckets are read-only (once closed) and reside on high-performance storage.

Answer

Frozen

Answer

Hot

Answer

Cold

Question 13

Which THREE components are part of the Splunk index directory structure?

Accepted Answer

coldPath. homePath, coldPath, and thawedPath are the main directory components.

Answer

hotPath

Answer

warmPath

Question 14

What is the purpose of the 'homePath.maxDataSizeMB' setting in indexes.conf?

Accepted Answer

Limits the total size of all hot/warm buckets in the homePath. It restricts the total size of the homePath directory, which forces bucket rotation if exceeded.

Answer

Sets the maximum size of a single hot bucket

Answer

Limits the number of buckets to 100

Answer

Sets the size limit for the cold path

Question 15

Which THREE actions can help resolve 'disk-full' status on an indexer?

Accepted Answer

Reduce frozenTimePeriodInSecs. To free disk space, you can reduce retention, increase compression, or move cold data to a larger volume.

Answer

Increase maxTotalDataSizeMB

Answer

Increase replication factor

Question 16

If you have a search head cluster and you want to accelerate a data model, where are the resulting summary files stored?

Accepted Answer

On the indexers. The accelerated summaries are stored on the indexers that contain the source data.

Answer

In the KV Store

Answer

On each search head member

Answer

On the deployer node

Question 17

A user wants to restore data from frozen buckets. What is the process for making this data searchable again?

Accepted Answer

Copy to the thawedPath and use the 'rebuild' command. The data must be thawed by copying the bucket to the thawed directory and restarting/triggering a refresh.

Answer

Directly copy files to the warm path

Answer

Change the frozenTimePeriodInSecs

Answer

Run 'splunk restore --bucket'

Question 18

Which TWO settings are crucial when planning for bucket replication in a clustered environment?

Accepted Answer

site_replication_factor. Replication factor and site replication factor are the core components of cluster bucket redundancy.

Answer

listen_port

Answer

max_hot_buckets

Answer

heartbeat_timeout

Question 19

You need to reduce the number of small buckets created in your index. Which parameter should you increase?

Accepted Answer

maxDataSize. Increasing maxDataSize increases the size of each bucket, thereby reducing the total count of buckets.

Answer

maxWarmDBCount

Answer

frozenTimePeriodInSecs

Answer

minHotBuckets

Question 20

Which THREE items should be included in an index sizing capacity plan?

Accepted Answer

Retention period (days). Capacity planning requires knowing the ingestion rate, retention requirements, and compression ratios to estimate space.

Answer

Search head version

Answer

Number of alerts configured