SPLK-2002 Data Lifecycle Management — 20 Questions

Question 1

A Splunk architect notices that Data Model Acceleration summaries are consuming excessive disk space. Which configuration setting in datamodels.conf should be adjusted to limit the storage impact of these summaries?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

acceleration.max_time. acceleration.max_time defines the retention period for the accelerated summaries.

Answer

acceleration.earliest_time

Answer

acceleration.backfill

Answer

acceleration.cron_schedule

Question 2

A large-scale Splunk deployment is experiencing 'bucket rolling' latency. Upon investigation, you determine that the indexer is waiting for the indexer cluster manager to acknowledge the bucket status. Which indexer clustering setting directly impacts the speed of bucket replication during the rolling process?

Accepted Answer

max_replication_streams. max_replication_streams controls how many concurrent replication streams an indexer can open when copying bucket data to peer indexers during bucket rolling and replication. Raising this value increases parallelism and speeds up replication, directly reducing the time the cluster manager waits to acknowledge bucket status. It is the clustering setting that most directly governs replication throughput during rolling.

Answer

search_factor

Answer

service_interval

Answer

heartbeat_timeout

Question 3

In a multisite indexer cluster, a bucket with replication factor 3 has its primary copy in Site 1 and secondary copies in Site 2. A network partition occurs. Which setting determines if the indexer will accept new data if it cannot reach the Site 2 indexers?

Accepted Answer

site_replication_factor. site_replication_factor determines the behavior for bucket replication across sites.

Answer

min_replication_factor

Answer

search_factor_per_site

Answer

cluster_replication_queue

Question 4

When designing an index strategy for high-frequency search performance, which component of the bucket lifecycle has the highest impact on disk I/O performance?

Accepted Answer

Hot/Warm buckets. Hot and Warm buckets are actively being written to and searched, so they reside on fast storage and generate the highest disk I/O. Their constant read/write activity makes them the most performance-critical part of the bucket lifecycle. Cold buckets are read-only and less frequently accessed, while summary and frozen buckets have minimal I/O impact.

Answer

Summary buckets

Answer

Cold buckets

Answer

Frozen buckets

Question 5

You are troubleshooting a performance issue where cold buckets are being moved to frozen storage too slowly. You find that the indexer is saturated with I/O operations. Which setting can be used to throttle the migration of cold buckets to frozen to improve system responsiveness?

Accepted Answer

coldToFrozenScript. There is no native 'throttle' setting for bucket freezing; however, the correct architectural approach for bucket lifecycle management often involves offloading the freezing process or managing throughput through indexer settings.

Answer

maxHotBuckets

Answer

rotatePeriodInSecs

Answer

maxTotalDataSizeMB

Question 6

An architect needs to implement a data retention policy that keeps data for 30 days in hot/warm and then moves it to cold storage for 60 days before deletion. Which attribute in indexes.conf controls the transition from warm to cold?

Accepted Answer

maxWarmDBCount. The homePath.maxDataSize is for sizing, but the movement of buckets is controlled by the MaxHotSpanSecs or more directly the frozenTimePeriodInSecs for deletion, while warm/cold transition is determined by the maxWarmDBCount or maxTotalDataSizeMB.

Answer

frozenTimePeriodInSecs

Answer

maxHotSpanSecs

Answer

coldPath.maxDataSizeMB

Question 7

Which path is used to define where Splunk stores the actual indexed data for a specific index?

Accepted Answer

homePath. The homePath in Splunk's indexes.conf defines the directory where the indexer stores the hot and warm buckets for a specific index. These buckets contain the most recent, searchable data. The homePath is the primary storage location for an index's data, making A the correct answer.

Answer

coldPath

Answer

frozenPath

Answer

thawedPath

Question 8

You are configuring Data Model Acceleration on a heavy forwarder. Why is this not a recommended architectural practice?

Accepted Answer

Acceleration requires the indexer components for summary storage. Data Model Acceleration (DMA) works by pre-computing and storing summarized results in TSIDX (time-series index) files, which are written to indexer buckets. Heavy forwarders lack the indexer storage layer and bucket management components needed to persist these summaries, so DMA cannot function on them. Splunk officially supports DMA only on indexers and search heads (with the appropriate search head clustering or indexer clustering configuration).

Answer

Heavy forwarders do not support accelerated datamodels

Answer

The license will be consumed incorrectly

Answer

CPU resources on the forwarder are too high

Question 9

Which command would you use to verify the current bucket status and size on a Splunk indexer?

Accepted Answer

splunk list buckets. splunk cmd splunkd bucket-info is a valid tool, but standard CLI is 'splunk show-buckets' or inspecting the filesystem.

Answer

splunk inspect data

Answer

splunk show-indexes

Answer

splunk check-storage

Question 10

What is the consequence of setting 'maxDataSize' to 'auto_high_volume' for an index?

Accepted Answer

It sets the bucket size to 10GB. The 'maxDataSize' setting in indexes.conf controls the maximum size a bucket can reach before it rolls from hot to warm. Setting it to 'auto_high_volume' tells Splunk to use a predefined bucket size of 10GB, which is optimized for high-volume indexing environments. This is a special keyword rather than a numeric value, and Splunk internally maps it to 10GB.

Answer

It disables data compression

Answer

It automatically enables bucket replication

Answer

It forces buckets to roll every 1 hour

Question 11

If you have a search head cluster and you want to accelerate a data model, where are the resulting summary files stored?

Accepted Answer

On the indexers. When a data model is accelerated in a search head cluster, the resulting summary files (tsidx files) are stored on the indexers, not on the search head members. This is because the acceleration search runs across the indexers, and the summary data is written back to the indexers' buckets so that subsequent accelerated searches can read the precomputed results directly from the indexers. This design distributes the storage and retrieval load across the indexer tier.

Answer

In the KV Store

Answer

On each search head member

Answer

On the deployer node

Question 12

Which setting in 'indexes.conf' controls the total amount of disk space occupied by the 'warm' buckets for a specific index?

Accepted Answer

maxWarmDBCount. maxWarmDBCount or maxTotalDataSizeMB are the standard ways to limit bucket growth.

Answer

maxDataSize

Answer

coldPath.maxDataSizeMB

Answer

maxHotSpanSecs

Question 13

When planning storage, which file type within an index bucket contains the actual raw log data?

Accepted Answer

journal.gz. The journal.gz file contains the compressed raw data.

Answer

rawdata

Answer

tsidx

Answer

meta

Question 14

Which bucket state is considered read-only but still resides on high-performance storage?

Accepted Answer

Warm. The warm bucket state is read-only but still resides on high-performance storage. Warm buckets are rolled from hot buckets when they reach a size or time threshold, and they remain on fast storage for continued search performance until they are rolled to cold.

Answer

Frozen

Answer

Hot

Answer

Cold

Question 15

Which TWO of the following are valid bucket states in the Splunk index lifecycle?

Accepted Answer

Hot. In the Splunk index lifecycle, buckets move through defined states based on age and rollover criteria, and both Hot (C) and Warm (E) are valid bucket states. A Hot bucket is the current, writable bucket that receives newly indexed data for an index; when it rolls to a new hot bucket (on size/time limits), the older bucket becomes Warm, which is still searchable but no longer receives writes. The other listed terms are not bucket states: Active (A) is not a Splunk bucket state, Pending (B) is not a lifecycle state for buckets, and System (D) is not a bucket state either (Splunk has internal/system indexes, but that is unrelated to bucket state names). Thus only Hot and Warm are correct.

Answer

Active

Answer

Pending

Answer

System

Question 16

Which TWO of these are valid methods for controlling bucket retention?

Accepted Answer

maxTotalDataSizeMB. Option A (maxTotalDataSizeMB) is correct because it is a valid setting in indexes.conf that controls bucket retention by rolling buckets to frozen (deleting them) once the total size of all buckets in the index exceeds the specified size in megabytes. Option E (frozenTimePeriodInSecs) is correct because it is the primary retention setting in indexes.conf that specifies the age, in seconds, at which buckets are frozen and removed from the index. Option B (maxWarmDBCount) is incorrect because it limits the number of warm buckets, not retention directly, and is a deprecated/legacy setting. Option C (maxHotSpanSecs) is incorrect because it controls the time span of hot buckets, not retention. Option D (index_auto_delete) is incorrect because it is not a valid Splunk configuration setting for controlling bucket retention.

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Answer

index_auto_delete

Question 17

Which TWO settings are crucial when planning for bucket replication in a clustered environment?

Accepted Answer

site_replication_factor. In a clustered Couchbase-style deployment, bucket replication planning hinges on two durability/redundancy settings: site_replication_factor (B) defines how many replicas of each document are kept across distinct sites/racks/zones for cross-site or multi-zone resilience, and replication_factor (D) defines the number of replica copies maintained within the cluster for intra-cluster high availability and failover. Both must be sized together so that the total number of copies (replicas plus active) satisfies the cluster's fault-tolerance goal without exceeding available nodes. The other options do not control replica count: listen_port (A) is a network binding/port setting, max_hot_buckets (C) governs resource limits on hot buckets rather than replication, and heartbeat_timeout (E) is a failure-detection timing parameter, not a replication-planning value.

Answer

listen_port

Answer

max_hot_buckets

Answer

heartbeat_timeout

Question 18

Which THREE items should be included in an index sizing capacity plan?

Accepted Answer

Retention period (days). Option C (Retention period in days) is correct because index size is directly proportional to how long data is kept before it ages out, so the plan must multiply daily volume by the retention window to derive raw storage needs. Option D (Daily ingestion rate in GB/day) is correct because it is the primary driver of index growth and, combined with retention, yields the total raw data volume to be stored. Option E (Compression ratio) is correct because indexed data is stored in compressed buckets, so the raw GB/day must be divided by the expected compression ratio (often around 50% or roughly 2:1 for typical machine data) to estimate actual on-disk footprint. Option A (Search head version) does not belong because search head software version affects search behavior and compatibility, not index storage sizing. Option B (Number of alerts configured) does not belong because alert count affects search load and scheduling, not the disk capacity required for the index.

Answer

Search head version

Answer

Number of alerts configured

Question 19

Which THREE configuration changes are required to enable bucket freezing to an external archival location using a custom script?

Accepted Answer

Set coldToFrozenScript. Option B is correct because the coldToFrozenScript setting in indexes.conf defines the custom script Splunk invokes to move bucket data to the external archival location when a bucket is frozen. Option D is correct because frozenPath in indexes.conf specifies the destination path (the external archival location) where frozen buckets are written, and it must be configured for the freezing process to have a target. Option E is correct because the custom script must reside in the bin directory (e.g., $SPLUNK_HOME/bin or the app's bin directory) so Splunk can locate and execute it. Option A is not required because the index replication factor governs indexer clustering replication, not bucket freezing to external storage. Option C is not required because indexer clustering is unrelated to enabling bucket freezing via a custom script.

Answer

Change index replication factor

Answer

Enable indexer clustering

Question 20

Which THREE actions occur during the SmartStore bucket lifecycle?

Accepted Answer

Upload bucket to remote storage. During the SmartStore bucket lifecycle, an upload bucket to remote storage (A) occurs when the indexer uploads a bucket's data to the remote object store (e.g., S3) so it is durably persisted off the indexers. An evict local copy to free space (B) then happens as the indexer deletes the local bucket copy once it is safely in remote storage, reclaiming local disk space. When a search needs that data again, a download bucket to local cache for searching (C) fetches the bucket back from remote storage into the local cache so the search can run. The unmarked options do not belong: automatic daily re-indexing (D) is not part of the SmartStore bucket lifecycle, and the replication factor is a fixed index setting that is not auto-increased (E) by SmartStore.

Answer

Automatic daily re-indexing

Answer

Auto-increase replication factor