SPLK-2002 Data Lifecycle Management Practice Test 2 — 15 Questions

Question 1

Which TWO of these are valid methods for controlling bucket retention?

Accepted Answer

maxTotalDataSizeMB. Option A (maxTotalDataSizeMB) is correct because it is a valid setting in indexes.conf that controls bucket retention by rolling buckets to frozen (deleting them) once the total size of all buckets in the index exceeds the specified size in megabytes. Option E (frozenTimePeriodInSecs) is correct because it is the primary retention setting in indexes.conf that specifies the age, in seconds, at which buckets are frozen and removed from the index. Option B (maxWarmDBCount) is incorrect because it limits the number of warm buckets, not retention directly, and is a deprecated/legacy setting. Option C (maxHotSpanSecs) is incorrect because it controls the time span of hot buckets, not retention. Option D (index_auto_delete) is incorrect because it is not a valid Splunk configuration setting for controlling bucket retention.

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Answer

index_auto_delete

Question 2

Which TWO settings are crucial when planning for bucket replication in a clustered environment?

Accepted Answer

site_replication_factor. In a clustered Couchbase-style deployment, bucket replication planning hinges on two durability/redundancy settings: site_replication_factor (B) defines how many replicas of each document are kept across distinct sites/racks/zones for cross-site or multi-zone resilience, and replication_factor (D) defines the number of replica copies maintained within the cluster for intra-cluster high availability and failover. Both must be sized together so that the total number of copies (replicas plus active) satisfies the cluster's fault-tolerance goal without exceeding available nodes. The other options do not control replica count: listen_port (A) is a network binding/port setting, max_hot_buckets (C) governs resource limits on hot buckets rather than replication, and heartbeat_timeout (E) is a failure-detection timing parameter, not a replication-planning value.

Answer

listen_port

Answer

max_hot_buckets

Answer

heartbeat_timeout

Question 3

Which THREE items should be included in an index sizing capacity plan?

Accepted Answer

Retention period (days). Option C (Retention period in days) is correct because index size is directly proportional to how long data is kept before it ages out, so the plan must multiply daily volume by the retention window to derive raw storage needs. Option D (Daily ingestion rate in GB/day) is correct because it is the primary driver of index growth and, combined with retention, yields the total raw data volume to be stored. Option E (Compression ratio) is correct because indexed data is stored in compressed buckets, so the raw GB/day must be divided by the expected compression ratio (often around 50% or roughly 2:1 for typical machine data) to estimate actual on-disk footprint. Option A (Search head version) does not belong because search head software version affects search behavior and compatibility, not index storage sizing. Option B (Number of alerts configured) does not belong because alert count affects search load and scheduling, not the disk capacity required for the index.

Answer

Search head version

Answer

Number of alerts configured

Question 4

Which THREE configuration changes are required to enable bucket freezing to an external archival location using a custom script?

Accepted Answer

Set coldToFrozenScript. Option B is correct because the coldToFrozenScript setting in indexes.conf defines the custom script Splunk invokes to move bucket data to the external archival location when a bucket is frozen. Option D is correct because frozenPath in indexes.conf specifies the destination path (the external archival location) where frozen buckets are written, and it must be configured for the freezing process to have a target. Option E is correct because the custom script must reside in the bin directory (e.g., $SPLUNK_HOME/bin or the app's bin directory) so Splunk can locate and execute it. Option A is not required because the index replication factor governs indexer clustering replication, not bucket freezing to external storage. Option C is not required because indexer clustering is unrelated to enabling bucket freezing via a custom script.

Answer

Change index replication factor

Answer

Enable indexer clustering

Question 5

Which THREE actions occur during the SmartStore bucket lifecycle?

Accepted Answer

Upload bucket to remote storage. During the SmartStore bucket lifecycle, an upload bucket to remote storage (A) occurs when the indexer uploads a bucket's data to the remote object store (e.g., S3) so it is durably persisted off the indexers. An evict local copy to free space (B) then happens as the indexer deletes the local bucket copy once it is safely in remote storage, reclaiming local disk space. When a search needs that data again, a download bucket to local cache for searching (C) fetches the bucket back from remote storage into the local cache so the search can run. The unmarked options do not belong: automatic daily re-indexing (D) is not part of the SmartStore bucket lifecycle, and the replication factor is a fixed index setting that is not auto-increased (E) by SmartStore.

Answer

Automatic daily re-indexing

Answer

Auto-increase replication factor

Question 6

Which THREE conditions cause a bucket to transition from Warm to Cold?

Accepted Answer

Exceeding homePath.maxDataSizeMB. In Splunk indexer bucket lifecycle, a bucket moves from Warm to Cold when it exceeds the warm bucket count limit set by maxWarmDBCount (option D), since the indexer rolls the oldest warm buckets to cold once that threshold is reached. It also transitions when the total size of warm buckets exceeds homePath.maxDataSizeMB (option A), forcing the oldest warm buckets to roll to cold to stay within the configured volume limit. Additionally, a bucket becomes cold when it is no longer the active bucket being written to and ages out of the warm set, i.e., it becomes inactive/too old (option E), which is the normal rolling behavior as newer buckets are created. Options B and C are incorrect because an indexing service restart or a search head cluster member failure does not itself change a bucket's temperature; bucket states are governed by indexer rolling policies, not by service restarts or search head availability.

Answer

Indexing service restart

Answer

Search head cluster member failure

Question 7

Which THREE actions can help resolve 'disk-full' status on an indexer?

Accepted Answer

Reduce frozenTimePeriodInSecs. Option A (Reduce frozenTimePeriodInSecs) is correct because this setting controls how long indexed data is retained before it rolls to frozen; lowering it causes older buckets to be frozen and removed from the indexer's active storage, freeing disk space. Option C (Decrease bucket count limits) is correct because Splunk's bucket count limits (e.g., maxHotBuckets, maxWarmDBCount, maxTotalDataSizeMB-related bucket caps) determine how many buckets are kept on the indexer; reducing these limits forces more aggressive bucket rolling and freezing, which reclaims disk space. Option E (Move cold buckets to a different volume) is correct because relocating cold buckets to another mounted volume offloads data from the full disk, directly relieving the disk-full condition without data loss. Option B (Increase maxTotalDataSizeMB) is not correct because raising this value allows more data to be retained, which would worsen rather than resolve a disk-full state. Option D (Increase replication factor) is not correct because a higher replication factor requires additional copies of bucket data across indexers, consuming more disk space rather than freeing it.

Answer

Increase maxTotalDataSizeMB

Answer

Increase replication factor

Question 8

Which TWO directories are typically found inside a Splunk bucket?

Accepted Answer

rawdata. Splunk buckets contain data files (journal.gz) and metadata/index files (tsidx).

Answer

configs

Answer

apps

Answer

logs

Question 9

Which THREE settings should you tune to optimize Data Model Acceleration?

Accepted Answer

acceleration.max_time. Option A, acceleration.max_time, is correct because it caps how long a Data Model Acceleration (DMA) build may run, preventing long-running builds from blocking subsequent scheduled runs and keeping the acceleration within the search head's resource budget. Option C, acceleration.cron_schedule, is correct because it defines when the acceleration search executes; tuning it to off-peak windows and appropriate frequency ensures the summary is refreshed without competing with user searches. Option D, acceleration.backfill, is correct because it controls how far back in time the acceleration initially populates the summary, and setting it appropriately limits the volume of historical data processed during the first build. Option B, index_retention, is not a DMA tuning setting but a data retention policy for indexes, and Option E, max_summary_size, is not a valid DMA acceleration parameter (summary size is governed by the acceleration's time range and the underlying data, not a max_summary_size setting).

Answer

index_retention

Answer

max_summary_size

Question 10

A Splunk architect is configuring index lifecycle management for a high-volume index. The index receives 200 GB/day and must retain data for 30 days. The architect wants to minimize search latency for recent data while optimizing storage costs. The indexer cluster uses SmartStore with a remote S3 bucket. Which configuration should the architect implement to ensure that buckets older than 7 days are moved to remote storage while keeping only the most recent buckets locally?

Accepted Answer

Configure the index with 'remotePath' pointing to S3 and set 'eviction_policy' to 'lru' with a 'max_cache_size' to control local retention.. To keep only recent buckets locally and move older ones to remote storage in SmartStore, the architect should configure the cache manager with an eviction policy such as LRU and set a maximum cache size. This ensures that when local storage reaches the limit, the least recently used buckets are evicted to remote storage, while frequently accessed recent buckets remain cached. This optimizes search performance for recent data and reduces local storage costs.

Answer

Use the 'remotePath' setting in indexes.conf to define the S3 bucket and set 'coldPath' to a local path for older buckets.

Answer

Set 'homePath.maxDataSizeMB' to a value that limits local storage, causing older buckets to roll to frozen and be archived to S3.

Answer

Set 'frozenTimePeriodInSecs' to 604800 (7 days) to move buckets to frozen and then to S3.

Question 11

A Splunk architect is designing an indexer cluster with SmartStore enabled. The remote storage is an S3-compatible object store. To optimize search performance and reduce cost, the architect wants to ensure that only buckets that are actively being searched are cached locally, while older buckets are evicted from the cache. Which cache manager setting should be configured to control the maximum size of the local cache?

Accepted Answer

max_cache_size. The `max_cache_size` setting in `server.conf` under `[cachemanager]` defines the upper limit for local disk space used by the SmartStore cache. By configuring this, the architect can ensure that only actively searched buckets remain cached, while older ones are evicted, balancing performance and cost.

Answer

eviction_policy

Answer

max_concurrent_downloads

Answer

cache_ttl

Question 12

A Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio. If the raw data volume doubles, how should the retention period be modified to maintain the original storage footprint?

Accepted Answer

Decrease retention to 15 days. If the raw data volume doubles, to maintain the same storage footprint, the retention period must be halved. Originally, 500GB/day for 30 days with 50% compression yields a certain storage size. Doubling the daily volume to 1000GB/day means you can only retain half as many days for the same total storage. Thus, retention should decrease to 15 days.

Answer

Keep retention at 30 days

Answer

Decrease retention to 7 days

Answer

Increase retention to 60 days

Question 13

An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?

Accepted Answer

An S3-compatible object store. SmartStore requires an S3-compatible object store as the remote storage tier because it uses the S3 API to upload and download bucket data (rawdata and tsidx) to remote storage while keeping only cache and metadata locally. Splunk supports Amazon S3, S3-compatible stores (e.g., MinIO, Dell ECS), Azure Blob, and GCS via the appropriate remote storage provider. Local RAID, NAS, or SAN do not expose the S3 API that SmartStore depends on.

Answer

A local RAID 10 array

Answer

A network-attached storage (NAS) with NFS v4

Answer

A SAN with Fibre Channel connectivity

Question 14

What happens to data when a bucket's 'frozenTimePeriodInSecs' is reached?

Accepted Answer

It is deleted or moved to a cold storage directory. When a bucket reaches its frozenTimePeriodInSecs, Splunk considers the data frozen. Depending on the index's frozenTimePeriodInSecs and coldToFrozenDir or coldToFrozenScript settings, the bucket is either deleted or archived to a cold storage directory. This is the final stage of the bucket lifecycle.

Answer

It is moved back to the hot bucket state

Answer

It is re-indexed for better performance

Answer

It is moved to the warm bucket state

Question 15

A Splunk architect is performing capacity planning. If an indexer receives 1TB of logs daily, and the Splunk compression factor is 1:10 (resulting in 100GB of storage per day), how much storage is needed for 30 days of data, including a 20% overhead for bucket overhead and metadata?

Accepted Answer

3.6 TB. The daily raw ingest is 1TB, which compresses at 1:10 to 100GB of on-disk storage per day. Over 30 days that is 100GB × 30 = 3TB of compressed data. Adding the 20% overhead for bucket metadata and index structures yields 3TB × 1.2 = 3.6TB, matching option A.

Answer

1.2 TB

Answer

3.0 TB

Answer

4.2 TB