SPLK-2002 Practice Questions 2 — 50 Questions

Question 1

What is the primary function of the 'Cluster Secret' in a Splunk Indexer Cluster?

Accepted Answer

To secure the communication between cluster nodes.. The Cluster Secret is a shared passphrase (set via the `pass4SymmKey` attribute in the `[clustering]` stanza of server.conf) that all peer nodes, the cluster master, and search heads use to authenticate each other when joining and communicating within the indexer cluster. It ensures that only nodes possessing the correct secret can participate in replication and cluster operations, effectively securing inter-node communication.

Answer

To define the replication factor.

Answer

To authorize search head access.

Answer

To manage indexer licensing.

Answer

To encrypt data in flight.

Question 2

When using a Search Head Cluster, what is the purpose of the 'captain'?

Accepted Answer

To coordinate search scheduling and replicate configuration bundles.. The captain in a Search Head Cluster coordinates search scheduling and replicates configuration bundles across the cluster members, ensuring consistent search execution and configuration. This is why option E is correct.

Answer

To act as the Cluster Master for indexers.

Answer

To store all bucket data for the indexers.

Answer

To receive data from forwarders.

Answer

To distribute search results to the end user.

Question 3

What is the primary benefit of 'bucket rolling' in an indexer?

Accepted Answer

Allows the indexer to optimize disk I/O by isolating active writing to a single bucket. Bucket rolling closes the currently active (hot) bucket once it reaches a size or age threshold and opens a new hot bucket for incoming data. This isolates all active writes to a single bucket, so the indexer avoids random writes across many files and can optimize disk I/O and caching. Older buckets become warm/cold and are read-only, which further improves write efficiency.

Answer

Enables the indexer to bypass the parsing queue

Answer

Increases the size of the bucket for better compression

Answer

Reduces the requirement for indexes to be searchable

Question 4

Which THREE metrics are critical for monitoring indexer health in the Monitoring Console?

Accepted Answer

Memory usage. Memory usage (A) is critical because indexers rely heavily on RAM for the index cache and search-time processing, and excessive memory pressure can cause swapping, slow searches, or crashes. Disk I/O latency (D) is critical because indexers continuously write buckets to disk and read them during searches, so high latency directly degrades indexing throughput and search performance. CPU utilization (E) is critical because indexing pipelines, search processing, and bucket merging are CPU-intensive, and sustained high utilization indicates the indexer is saturated. The number of active apps (B) and number of logged-in users (C) are not indexer health metrics; they relate to user activity or app deployment rather than the performance and stability of the indexing tier.

Answer

Number of active apps

Answer

Number of logged-in users

Question 5

A user wants to restore data from frozen buckets. What is the process for making this data searchable again?

Accepted Answer

Copy to the thawedPath and use the 'rebuild' command. To restore frozen buckets, you copy the bucket files to the thawedPath directory defined in indexes.conf, then run the splunk rebuild command on that bucket directory to regenerate the necessary metadata (such as the .tsidx and bucket manifest files) so Splunk can search the data again. Simply placing files in the thawed path without rebuilding leaves the bucket unrecognized and unsearchable.

Answer

Directly copy files to the warm path

Answer

Change the frozenTimePeriodInSecs

Answer

Run 'splunk restore --bucket'

Question 6

You are troubleshooting a slow indexer cluster. You identify that the 'replication_port' is experiencing high latency. Where is the replication port defined?

Accepted Answer

server.conf. The replication_port setting is defined in server.conf under the [replication_port://<port>] stanza. It specifies the port on which an indexer listens for replication data from peer indexers in an indexer cluster. Since server.conf holds cluster-wide and node-level server settings, this is the correct file for replication port configuration.

Answer

indexes.conf

Answer

inputs.conf

Answer

cluster.conf

Question 7

What is the recommended way to handle an indexer peer that is permanently failing in an Indexer Cluster?

Accepted Answer

Use the 'splunk offline' command on the peer.. The 'splunk offline' command is the supported, graceful way to take an indexer peer out of an indexer cluster. It triggers the peer to flush its buckets, notify the Cluster Master, and allow the cluster to re-replicate any buckets for which the peer was primary, maintaining RF and SF. This is the recommended procedure for permanently failing or decommissioning a peer.

Answer

Ignore the peer and wait for timeout.

Answer

Delete the indexer's data directory manually.

Answer

Update the master node configuration.

Answer

Shutdown the service without notice.

Question 8

Which command is used to check the health of an Indexer Cluster from the Cluster Master CLI?

Accepted Answer

splunk show cluster-status. The command 'splunk show cluster-status' is used on the Cluster Master (now called Cluster Manager) to display the health and status of the indexer cluster, including information about peers, replication, and search factors. It provides a summary of the cluster's overall state.

Answer

splunk cluster-check

Answer

splunk inspect-cluster

Answer

splunk search-peers

Answer

splunk list indexers

Question 9

You are investigating why an indexer node is not reporting to the Cluster Master. Which THREE of the following are the most likely causes?

Accepted Answer

The security key ('pass4SymmKey') is mismatched. Option B is correct because the pass4SymmKey in the [clustering] stanza of server.conf must match across all cluster members and the master; a mismatch prevents the indexer from authenticating and registering with the Cluster Master. Option C is correct because indexers communicate with the master over the management port (default 8089), so a firewall blocking that port stops the indexer from reporting its status. Option E is correct because an indexer must be configured with the cluster-member role (mode = slave in [clustering]) to join and report to the master; without it, the instance never registers. Option A is not a cause because warm bucket count affects disk usage and search performance, not cluster registration. Option D is not a cause because the replication port (default 9887) is used for peer-to-peer bucket replication between indexers, not for reporting to the Cluster Master.

Answer

The indexer has too many warm buckets

Answer

The replication port is blocked by a firewall

Question 10

In a multi-site indexer cluster, which setting controls the number of copies of data kept per site?

Accepted Answer

site_replication_factor. In a multi-site indexer cluster, site_replication_factor is the setting in server.conf (under the [clustering] stanza) that defines how many copies of each bucket must exist within each site. It works alongside replication_factor, which sets the total number of copies across all sites. This ensures site-level redundancy so that a site failure does not cause data loss.

Answer

max_site_copies

Answer

site_data_count

Answer

cross_site_replication

Question 11

When configuring a Search Head Cluster, what does the 'captain' role do that other members do not?

Accepted Answer

It manages the cluster membership and configuration replication. The captain in a Search Head Cluster (SHC) is elected from among the members and is responsible for managing cluster membership, replicating configuration changes (via the deployer-pushed configs and the SHC's internal replication), and coordinating artifact replication. Other members perform searches and serve users but do not handle these cluster-management duties.

Answer

It acts as the primary user interface node

Answer

It stores all the search results

Answer

It performs all the searches for the cluster

Question 12

When managing indexer clustering, what is the impact of a high 'replication_factor' on indexing performance?

Accepted Answer

Increases indexing latency due to synchronous replication requirements. A high replication_factor means each bucket must be replicated to more indexer peers before the data is considered safely indexed. Because replication is synchronous for hot buckets in an indexer cluster, the indexing pipeline waits for acknowledgments from all required peers, increasing indexing latency. This is the direct performance impact.

Answer

Allows for faster data ingestion without resource constraints

Answer

Improves search speed by reducing data density

Answer

Decreases indexer storage requirements

Question 13

An Indexer Cluster is in 'Maintenance Mode'. Which THREE of the following implications must be considered during this time?

Accepted Answer

The peers will continue to index incoming data normally. In Splunk maintenance mode, option A is correct because the indexer peers keep indexing incoming data normally; maintenance mode only suppresses certain master-level activities, not data ingestion. Option B is correct because the cluster master stops alerting on missing buckets, so replication/primacy violations are not reported during this window. Option E is correct because the master also halts bucket fix-up activities, meaning it will not attempt to search for and replicate or restore missing bucket copies. Option C is wrong because the master does not force an immediate bucket re-balance in maintenance mode; rebalancing is a separate, manual operation. Option D is wrong because searches are not automatically disabled by maintenance mode; search functionality continues unless separately restricted.

Answer

The Master will force a bucket re-balance immediately

Answer

All searches will be automatically disabled

Question 14

What happens to a search job if the Search Head Cluster captain goes down during an active search?

Accepted Answer

A new captain is elected and search jobs are recovered.. In a Search Head Cluster, the captain is a dynamically elected member that coordinates configuration replication and search scheduling. If the captain goes down, a new captain is elected from the remaining members, and active search jobs are recovered and continue. This provides high availability and fault tolerance.

Answer

The search head cluster becomes read-only.

Answer

Indexers stop processing data.

Answer

The entire cluster must be restarted.

Answer

The search job is canceled immediately.

Question 15

When configuring search affinity for a multi-site cluster, what is the behavior if no indexers are available in the local site?

Accepted Answer

The search head queries indexers in other sites.. In a Splunk multi-site cluster, search affinity is a performance optimization that prefers indexers in the same site as the search head to reduce latency and WAN traffic. However, it is not a hard constraint: if no indexers in the local site are available (e.g., all are down, busy, or in maintenance mode), the search head automatically falls back to querying indexers in other sites. This ensures search continuity and availability, which is a core design goal of Splunk's distributed search architecture.

Answer

The search fails immediately.

Answer

The search head waits for the local indexer to return.

Answer

The search head only returns partial results.

Answer

The search head reports an error to the user.

Question 16

You are troubleshooting a configuration bundle replication issue in an Indexer Cluster. The peers are not receiving the latest configuration from the Master. What is the first thing you should check on the Cluster Master?

Accepted Answer

splunk validate cluster-bundle. When peers are not receiving the latest configuration bundle, the first diagnostic step on the Cluster Master is to validate the bundle with 'splunk validate cluster-bundle'. This command checks the bundle for syntax errors, invalid configurations, or missing files before it is pushed to peers, and it reports exactly what is wrong so you can fix the source rather than guessing.

Answer

Check the replication_port

Answer

Restart the Master

Answer

Check /etc/apps for errors

Question 17

What is the purpose of the 'homePath.maxDataSizeMB' setting in indexes.conf?

Accepted Answer

Limits the total size of all hot/warm buckets in the homePath. homePath.maxDataSizeMB sets the maximum total size, in megabytes, of all hot and warm buckets stored in the index's homePath. When this limit is reached, Splunk rolls the oldest warm buckets to the coldPath to free space, making it a retention and capacity control for the homePath volume.

Answer

Sets the maximum size of a single hot bucket

Answer

Limits the number of buckets to 100

Answer

Sets the size limit for the cold path

Question 18

Which TWO items are stored in the index directory?

Accepted Answer

TSIDX files. In Splunk, the index directory (e.g., $SPLUNK_HOME/var/lib/splunk/defaultdb/db) stores the indexed data itself, which includes both the rawdata files (compressed journal slices) and the TSIDX files that hold the time-series index used to locate events quickly, so options B and C are correct. TSIDX files map timestamps and terms to the rawdata slices, and the rawdata files are the compressed, bucket-organized copies of the ingested events. License master keys are not stored in the index directory; they are managed by the license manager (in $SPLUNK_HOME/etc/licenses or the license pool configuration). Search logs are written to $SPLUNK_HOME/var/log/splunk (e.g., search.log per search job), not the index directory. App configuration files live under $SPLUNK_HOME/etc/apps (and related etc directories), not in the index storage.

Answer

License master keys

Answer

Search logs

Answer

App configuration files

Question 19

If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?

Accepted Answer

2. In an Indexer Cluster, the search_factor defines how many searchable copies of each bucket are maintained across the cluster. With a search_factor of 2, exactly two searchable copies of each bucket exist. The replication_factor (3) determines the total number of copies (searchable plus non-searchable), but the search_factor specifically governs searchable copies.

Answer

5

Answer

4

Answer

1

Answer

3

Question 20

Which THREE components are part of the Splunk index directory structure?

Accepted Answer

coldPath. In Splunk's indexes.conf, each index defines three path settings that make up its on-disk directory structure: coldPath (B), homePath (D), and thawedPath (E). homePath holds the hot and warm buckets (the newly written, actively searchable data), coldPath stores buckets that have rolled from warm to cold, and thawedPath is where archived buckets are restored when an admin runs the rebuild command to bring them back online. These three are the actual configurable path attributes of an index, so B, D, and E are correct. The other options are not valid index path settings: hotPath (A) and warmPath (C) do not exist as separate configuration keys because hot and warm buckets both reside under homePath, so they are not part of the index directory structure.

Answer

hotPath

Answer

warmPath