SPLK-2002 Practice Questions 1 — 50 Questions

Question 1

What is the primary function of the 'Cluster Master' in an Indexer Cluster?

Accepted Answer

To manage the indexer cluster's configuration and bucket state. The Cluster Master (now called Cluster Manager in newer versions) in an Indexer Cluster is responsible for managing the cluster's configuration and bucket state. It coordinates replication, tells indexers which buckets to replicate, manages search affinity, and handles peer registration. It does not handle data ingestion or serve the UI.

Answer

To handle incoming data from universal forwarders

Answer

To serve the Splunk user interface

Answer

To search across all indexers

Question 2

Which TWO of the following are valid ways to monitor the status of an Indexer Cluster?

Accepted Answer

Using the CLI command 'splunk show cluster-status'.. Option B is correct because the Splunk CLI command 'splunk show cluster-status' (run on a cluster manager or member) reports the health and status of the indexer cluster, including peer and search head connectivity and replication status. Option C is correct because the Monitoring Console provides a dedicated Indexer Clustering dashboard that surfaces cluster health, peer status, replication and search factor compliance, and bucket-fixup activity. Option A is incorrect because license usage logs track license consumption, not cluster health or peer status. Option D is incorrect because forwarder logs show data forwarding activity and connectivity from the forwarder's perspective, not the status of the indexer cluster itself. Option E is incorrect because running a search on indexers tests search functionality but does not provide a valid, supported method for monitoring overall indexer cluster status.

Answer

Checking the license usage logs.

Answer

Reviewing the forwarder logs.

Answer

Running a search on the indexers directly.

Question 3

You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?

Accepted Answer

Use the local/ directory for configuration files that should not be replicated. In a Search Head Cluster, configurations are replicated from the deployer or captain via bundles, but files in the local/ directory of an app or system are not replicated and are preserved on each member. To keep local user configurations from being overwritten by cluster-wide bundles, you place them in the local/ directory, which takes precedence and is not overwritten by replicated configurations.

Answer

Move files to the var/run directory

Answer

Set the configuration to immutable in server.conf

Answer

Use the shcluster/ directory

Question 4

When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?

Accepted Answer

To define the number of copies of search artifacts. In an SHC, the replication_factor defines how many copies of the search-related configurations are replicated across members.

Answer

To limit the number of users

Answer

To specify the number of search nodes in the cluster

Answer

To balance the search load across nodes

Question 5

Which type of bucket is used for the most recent data and is generally searchable?

Accepted Answer

Hot. Hot buckets contain the most recent, actively written data and are the only bucket type that is both writable and searchable in real time. When data ages or reaches a size threshold, hot buckets roll to warm, which are searchable but no longer written to. Therefore hot is the correct answer for 'most recent data and generally searchable.'

Answer

Warm

Answer

Cold

Answer

Frozen

Answer

Thawed

Question 6

An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?

Accepted Answer

An S3-compatible object store. SmartStore requires an S3-compatible object store as the remote storage tier because it uses the S3 API to upload and download bucket data (rawdata and tsidx) to remote storage while keeping only cache and metadata locally. Splunk supports Amazon S3, S3-compatible stores (e.g., MinIO, Dell ECS), Azure Blob, and GCS via the appropriate remote storage provider. Local RAID, NAS, or SAN do not expose the S3 API that SmartStore depends on.

Answer

A local RAID 10 array

Answer

A network-attached storage (NAS) with NFS v4

Answer

A SAN with Fibre Channel connectivity

Question 7

If a search head is overloaded with concurrent searches, what is the best strategy to offload the processing?

Accepted Answer

Implement a Search Head Cluster. A Search Head Cluster distributes search workload across multiple search head members, allowing concurrent searches to be load-balanced and providing horizontal scaling for search processing. This directly addresses an overloaded single search head by adding capacity and redundancy. Increasing indexers or indexer memory addresses indexing/search execution at the indexer layer, not the search head's concurrency bottleneck.

Answer

Increase the number of indexers

Answer

Reduce the number of users

Answer

Increase indexer memory

Question 8

An architect is designing an index lifecycle for compliance. The requirement is to keep data for exactly 7 years. Which setting must be configured to prevent premature deletion?

Accepted Answer

frozenTimePeriodInSecs. frozenTimePeriodInSecs is the index-level setting in indexes.conf that defines the age (in seconds) at which buckets roll from cold to frozen, triggering deletion (or archival if a coldToFrozenScript/archiver is configured). Setting it to 7 years (220,752,000 seconds) ensures data is retained for exactly that period before being frozen. This is the only setting in the list that controls retention by time rather than by size or count.

Answer

maxTotalDataSizeMB

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Question 9

You are troubleshooting a KV store issue in an Indexer Cluster. Which command allows you to verify the status of the KV store and its replication on a node?

Accepted Answer

splunk show kvstore-status. The command 'splunk show kvstore-status' is the supported CLI command to display the KV Store status on a Splunk instance, including replication status, port, and storage engine details. It works on indexers, search heads, and cluster members, making it the correct tool for verifying KV Store health and replication in an Indexer Cluster.

Answer

mongostat

Answer

check_kvstore.py

Answer

splunk status kvstore

Question 10

Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?

Accepted Answer

Service load is too high causing timeouts.. Option A is correct because a Search Head Cluster member under excessive service load can fail to respond to the captain's periodic heartbeats within the configured timeout, causing the captain to mark it as down and lose contact. Option D is correct because network instability (packet loss, latency, or intermittent connectivity) disrupts the heartbeat and replication traffic between members and the captain, breaking the cluster communication. Option E is correct because the captain and members communicate over the replication port (default 9887), so if a firewall blocks that port, the member cannot exchange heartbeats or replicate artifacts and loses contact with the captain. Option B is not a cause because the license master is unrelated to SHC captain heartbeat communication; a member can remain in contact with the captain even if licensing is unavailable. Option C is not a cause because indexer cluster load affects search and indexing performance, not the SHC internal captain-member heartbeat channel.

Answer

License master is offline.

Answer

The indexer cluster is busy.

Question 11

In an Indexer Cluster, which component stores the 'bucket' index files?

Accepted Answer

Indexer Peer. In a Splunk Indexer Cluster, the indexer peers are the nodes that actually receive, index, and store the raw data in the form of buckets. Buckets are directories containing rawdata, index files, and metadata, and they reside on the indexer peers' filesystems. The cluster master coordinates replication and searchability, but it does not store the bucket files themselves.

Answer

Search Head

Answer

Cluster Master

Answer

Deployment Server

Question 12

You are using the Monitoring Console to view the 'Search Head Clustering: Status' dashboard. You see that one of the nodes is showing as 'Missing'. What does this status imply?

Accepted Answer

The captain has not received a heartbeat from the node. In the Search Head Clustering: Status dashboard, a node showing 'Missing' means the cluster captain has not received a heartbeat from that node within the expected interval. The captain tracks member health via heartbeats, and a missing heartbeat indicates the node is unreachable, down, or partitioned from the cluster. This is a connectivity/health signal, not a performance or licensing state.

Answer

The node is overloaded

Answer

The node is in maintenance mode

Answer

The node has an invalid license

Question 13

You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?

Accepted Answer

Indexer Cluster: Status. The Monitoring Console's 'Indexer Cluster: Status' dashboard is purpose-built to show a high-level health view of all indexer cluster nodes, including peer status, replication and search factor compliance, and bucket replication status. It aggregates cluster health so you can quickly see whether the cluster is fully replicated and whether any peers are down or lagging. The other dashboards focus on performance, resource usage, or distributed search rather than cluster replication health.

Answer

Indexing Performance: Cluster

Answer

Resource Usage: Indexer Cluster

Answer

Distributed Search: Status

Question 14

You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?

Accepted Answer

Search affinity. Search affinity is the Search Head Cluster feature that keeps a search on a search head located in the same site as the indexers holding the data, minimizing cross-site traffic. When search affinity is enabled, the SHC captain assigns searches to members based on the site of the indexers that own the relevant buckets. This is distinct from indexer discovery or site-aware routing, which operate at the indexer/forwarder layer rather than the search head layer.

Answer

Site-aware routing

Answer

Data locality

Answer

Load balancing

Question 15

A user claims that a search is not returning data from a specific time range. You suspect the data has been rolled to cold storage and the cold storage is not being searched. Which configuration file controls which cold paths are included in the search?

Accepted Answer

indexes.conf. The indexes.conf file defines index properties, including the paths for hot, warm, cold, and frozen buckets. The 'coldPath' setting specifies where cold buckets are stored, and Splunk searches these paths by default unless configured otherwise. Therefore, indexes.conf controls which cold paths are included in searches.

Answer

distsearch.conf

Answer

server.conf

Answer

limits.conf

Question 16

In an indexer cluster, why might you use the 'splunk list cluster-peers' command?

Accepted Answer

To verify the synchronization status of all indexer peers. The 'splunk list cluster-peers' command queries the cluster master and returns the status of all peer nodes, including whether each peer is Up, Down, or in a degraded state, along with its replication and searchability status. It is the standard CLI tool for verifying peer synchronization and health in an indexer cluster. It does not modify cluster state; it is read-only diagnostic output.

Answer

To remove a node from the cluster

Answer

To update the license configuration

Answer

To force a cluster rebalance

Question 17

You notice that the Monitoring Console (MC) reports a 'Disk usage' warning for an indexer. Which dashboard should you navigate to in order to identify which specific index is consuming the most disk space?

Accepted Answer

Indexes and Volumes: Instance. The Monitoring Console's 'Indexes and Volumes: Instance' dashboard shows per-index disk usage on a specific indexer instance, including the size of each index and its volumes. This is the correct dashboard to identify which index is consuming the most disk space when a Disk usage warning fires. It breaks down usage by index, making the culprit immediately visible.

Answer

Indexing Performance: Instance

Answer

Resource Usage: Indexer Instance

Answer

Cluster Status

Question 18

Which configuration file is used to specify the disk path where index buckets are stored?

Accepted Answer

indexes.conf. The indexes.conf file is the central configuration file for defining and managing indexes in Splunk. Within each index stanza, the 'homePath' setting specifies the directory where the index's hot and warm buckets are stored, and 'coldPath' specifies where cold buckets are stored. Therefore, indexes.conf is the correct file to specify the disk path for index buckets.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 19

When implementing a multisite indexer cluster, what happens if the cluster master becomes unreachable for a short duration?

Accepted Answer

Indexer peers continue to accept and index data. In a multisite indexer cluster, if the cluster master becomes unreachable for a short duration, indexer peers continue to accept and index data. The master is responsible for coordinating replication and search affinity, but peers can operate independently for a period. Indexing does not stop immediately, and search heads can still return results from available peers. Replication across sites is not forced immediately; it continues based on existing policies.

Answer

All indexing stops immediately

Answer

Search heads stop returning results

Answer

Data replication across sites is forced immediately

Question 20

In a SmartStore architecture, what happens when a bucket is evicted from local cache?

Accepted Answer

The local disk space is freed. In SmartStore, buckets are cached locally on indexers for search performance, but when the cache fills, the cache manager evicts buckets back to remote storage (S3, Azure Blob, GCS). Eviction frees the local disk space occupied by that bucket's data, allowing new buckets to be cached. The bucket remains fully searchable because it can be re-fetched from remote storage on demand.

Answer

The bucket is moved to the cold path

Answer

The bucket is no longer searchable

Answer

The bucket is deleted from remote storage