SPLK-2002 Practice Test 5 — 10 Questions

Question 1

Which THREE conditions cause a bucket to transition from Warm to Cold?

Accepted Answer

Exceeding homePath.maxDataSizeMB. Transitions to cold happen based on the maxWarmDBCount, maxTotalDataSizeMB, or total data age limits.

Answer

Indexing service restart

Answer

Search head cluster member failure

Question 2

Which bucket state is considered read-only but still resides on high-performance storage?

Accepted Answer

Warm. Warm buckets are read-only (once closed) and reside on high-performance storage.

Answer

Frozen

Answer

Hot

Answer

Cold

Question 3

Which THREE components are part of the Splunk index directory structure?

Accepted Answer

coldPath. homePath, coldPath, and thawedPath are the main directory components.

Answer

hotPath

Answer

warmPath

Question 4

What is the purpose of the 'homePath.maxDataSizeMB' setting in indexes.conf?

Accepted Answer

Limits the total size of all hot/warm buckets in the homePath. It restricts the total size of the homePath directory, which forces bucket rotation if exceeded.

Answer

Sets the maximum size of a single hot bucket

Answer

Limits the number of buckets to 100

Answer

Sets the size limit for the cold path

Question 5

Which THREE actions can help resolve 'disk-full' status on an indexer?

Accepted Answer

Reduce frozenTimePeriodInSecs. To free disk space, you can reduce retention, increase compression, or move cold data to a larger volume.

Answer

Increase maxTotalDataSizeMB

Answer

Increase replication factor

Question 6

If you have a search head cluster and you want to accelerate a data model, where are the resulting summary files stored?

Accepted Answer

On the indexers. The accelerated summaries are stored on the indexers that contain the source data.

Answer

In the KV Store

Answer

On each search head member

Answer

On the deployer node

Question 7

A user wants to restore data from frozen buckets. What is the process for making this data searchable again?

Accepted Answer

Copy to the thawedPath and use the 'rebuild' command. The data must be thawed by copying the bucket to the thawed directory and restarting/triggering a refresh.

Answer

Directly copy files to the warm path

Answer

Change the frozenTimePeriodInSecs

Answer

Run 'splunk restore --bucket'

Question 8

Which TWO settings are crucial when planning for bucket replication in a clustered environment?

Accepted Answer

site_replication_factor. Replication factor and site replication factor are the core components of cluster bucket redundancy.

Answer

listen_port

Answer

max_hot_buckets

Answer

heartbeat_timeout

Question 9

You need to reduce the number of small buckets created in your index. Which parameter should you increase?

Accepted Answer

maxDataSize. Increasing maxDataSize increases the size of each bucket, thereby reducing the total count of buckets.

Answer

maxWarmDBCount

Answer

frozenTimePeriodInSecs

Answer

minHotBuckets

Question 10

Which THREE items should be included in an index sizing capacity plan?

Accepted Answer

Retention period (days). Capacity planning requires knowing the ingestion rate, retention requirements, and compression ratios to estimate space.

Answer

Search head version

Answer

Number of alerts configured