SPLK-2002 Practice Questions 1 — 50 Questions

Question 1

Which TWO of these factors determine when a bucket rolls from hot to warm?

Accepted Answer

maxDataSize. Bucket rolling is triggered by either the size (maxDataSize) or time (maxHotSpanSecs).

Answer

maxWarmDBCount

Answer

maxTotalDataSizeMB

Answer

frozenTimePeriodInSecs

Question 2

In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?

Accepted Answer

Maintaining the bucket registry and managing replication status.. The CM assigns bucket IDs and manages bucket replication/searchability across peers, but it does not store the raw indexed data itself.

Answer

Directing search requests to specific indexers.

Answer

Indexing incoming forwarder data.

Answer

Storing raw data and serving search requests.

Answer

Aggregating search results from indexers.

Question 3

Which setting in indexes.conf should be tuned to balance memory usage and indexing speed for a high-volume indexer?

Accepted Answer

maxDataSize. maxDataSize determines the size of the TSIDX files before rolling, which impacts how often the indexer performs merge operations.

Answer

hot_bucket_count

Answer

io_priority

Answer

block_size

Question 4

You are configuring Data Model Acceleration on a heavy forwarder. Why is this not a recommended architectural practice?

Accepted Answer

Acceleration requires the indexer components for summary storage. Heavy forwarders lack the indexing and search head components required to manage and serve accelerated summaries efficiently.

Answer

Heavy forwarders do not support accelerated datamodels

Answer

The license will be consumed incorrectly

Answer

CPU resources on the forwarder are too high

Question 5

When using a Search Head Cluster, what is the purpose of the 'captain'?

Accepted Answer

To coordinate search scheduling and replicate configuration bundles.. The captain manages the search head cluster's configuration, coordinates job scheduling, and maintains the cluster state.

Answer

To act as the Cluster Master for indexers.

Answer

To store all bucket data for the indexers.

Answer

To receive data from forwarders.

Answer

To distribute search results to the end user.

Question 6

Which TWO of the following are valid bucket states in the Splunk index lifecycle?

Accepted Answer

Hot. Hot, Warm, Cold, and Frozen are the standard lifecycle states.

Answer

Active

Answer

Pending

Answer

System

Question 7

An indexer cluster is suffering from 'bucket repair' loops. What is the most likely cause related to the bucket lifecycle?

Accepted Answer

Bucket corruption preventing indexer recovery. Bucket corruption is often due to improper shutdown or hardware failure, but repair loops specifically indicate an issue with the bucket's integrity on disk.

Answer

Insufficient replication factor

Answer

Excessive search concurrency

Answer

Misconfigured cold path

Question 8

You have added a new indexer to a cluster. The indexer is up, but the Cluster Master does not show it as 'Ready'. What is the most likely cause?

Accepted Answer

The security key on the indexer does not match the Cluster Master. The 'Ready' state requires the indexer to be connected and acknowledged by the master, often failing if the security keys do not match.

Answer

The indexer is missing the license file

Answer

The cluster master is in maintenance mode

Answer

The indexer has not indexed any data yet

Question 9

A customer is experiencing 'Search peer [peer-name] is not responding' errors during indexer maintenance. Which configuration parameter in server.conf should be tuned to prevent search failures during rolling restarts?

Accepted Answer

restart_timeout. The 'restart_timeout' parameter in the [clustering] stanza controls how long a search head waits for a peer to return before marking it as down during a rolling restart.

Answer

peer_down_timeout

Answer

max_search_time

Answer

heartbeat_timeout

Answer

search_retry_timeout

Question 10

Which THREE settings should you tune to optimize Data Model Acceleration?

Accepted Answer

acceleration.max_time. Acceleration is managed through the datamodels.conf file, specifically regarding backfill, retention, and cron schedules.

Answer

index_retention

Answer

max_summary_size

Question 11

Which metric is the best predictor of the storage needed for an indexer in a cluster?

Accepted Answer

Daily ingestion volume. Daily ingestion volume is the primary driver for capacity planning.

Answer

Number of forwarders

Answer

Search concurrency

Answer

Number of users

Question 12

A Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio. If the raw data volume doubles, how should the retention period be modified to maintain the original storage footprint?

Accepted Answer

Decrease retention to 15 days. If volume doubles (1000GB/day) and storage space must remain constant, the retention must be halved (15 days) to keep the total stored data volume equivalent.

Answer

Keep retention at 30 days

Answer

Decrease retention to 7 days

Answer

Increase retention to 60 days

Question 13

Which configuration file and stanza are used to define the bucket lifecycle policy for a custom index named 'customer_data'?

Accepted Answer

indexes.conf [customer_data]. indexes.conf is the standard file where index-specific lifecycle settings are defined.

Answer

datamodels.conf [customer_data]

Answer

server.conf [customer_data]

Answer

inputs.conf [customer_data]

Question 14

A Splunk architect is performing capacity planning. If an indexer receives 1TB of logs daily, and the Splunk compression factor is 1:10 (resulting in 100GB of storage per day), how much storage is needed for 30 days of data, including a 20% overhead for bucket overhead and metadata?

Accepted Answer

3.6 TB. 100GB * 30 days = 3000GB. 3000GB * 1.20 = 3600GB or 3.6TB.

Answer

1.2 TB

Answer

3.0 TB

Answer

4.2 TB

Question 15

An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?

Accepted Answer

An S3-compatible object store. SmartStore requires S3-compatible object storage (AWS S3, Google Cloud Storage, or Azure Blob Storage).

Answer

A local RAID 10 array

Answer

A network-attached storage (NAS) with NFS v4

Answer

A SAN with Fibre Channel connectivity

Question 16

A large-scale Splunk deployment is experiencing 'bucket rolling' latency. Upon investigation, you determine that the indexer is waiting for the indexer cluster manager to acknowledge the bucket status. Which indexer clustering setting directly impacts the speed of bucket replication during the rolling process?

Accepted Answer

max_replication_streams. replication_factor impacts the number of copies, but the throughput of bucket replication is managed by the replication queue settings.

Answer

search_factor

Answer

service_interval

Answer

heartbeat_timeout

Question 17

Which THREE factors influence the disk I/O performance of an indexer cluster?

Accepted Answer

Search concurrency. Disk I/O is impacted by ingestion rate, search concurrency, and the type of storage used (e.g., SSD vs HDD).

Answer

Deployment server latency

Answer

Number of users logged in

Question 18

Which component in a distributed search environment is responsible for the 'Search Affinity' feature?

Accepted Answer

Search Head. Search affinity allows a Search Head to prefer indexers within the same site, reducing cross-site bandwidth usage.

Answer

Deployment Server

Answer

License Master

Answer

Indexer Peer

Answer

Cluster Master

Question 19

When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?

Accepted Answer

To define the number of copies of search artifacts. In an SHC, the replication_factor defines how many copies of the search-related configurations are replicated across members.

Answer

To limit the number of users

Answer

To specify the number of search nodes in the cluster

Answer

To balance the search load across nodes

Question 20

If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?

Accepted Answer

2. The search factor determines how many copies of a bucket are searchable. If search_factor is 2, the cluster ensures at least two copies are available for searching.

Answer

5

Answer

4

Answer

1

Answer

3