SPLK-2002 Data Lifecycle Management Practice Test 2 — 15 Questions

Question 1

You are configuring Data Model Acceleration on a heavy forwarder. Why is this not a recommended architectural practice?

Accepted Answer

Acceleration requires the indexer components for summary storage. Heavy forwarders lack the indexing and search head components required to manage and serve accelerated summaries efficiently.

Answer

Heavy forwarders do not support accelerated datamodels

Answer

The license will be consumed incorrectly

Answer

CPU resources on the forwarder are too high

Question 2

What is the consequence of setting 'maxDataSize' to 'auto_high_volume' for an index?

Accepted Answer

It sets the bucket size to 10GB. auto_high_volume creates 10GB buckets to reduce the number of buckets, which is beneficial for large indexing volumes.

Answer

It disables data compression

Answer

It automatically enables bucket replication

Answer

It forces buckets to roll every 1 hour

Question 3

If you have a search head cluster and you want to accelerate a data model, where are the resulting summary files stored?

Accepted Answer

On the indexers. The accelerated summaries are stored on the indexers that contain the source data.

Answer

In the KV Store

Answer

On each search head member

Answer

On the deployer node

Question 4

An indexer cluster is suffering from 'bucket repair' loops. What is the most likely cause related to the bucket lifecycle?

Accepted Answer

Bucket corruption preventing indexer recovery. Bucket corruption is often due to improper shutdown or hardware failure, but repair loops specifically indicate an issue with the bucket's integrity on disk.

Answer

Insufficient replication factor

Answer

Excessive search concurrency

Answer

Misconfigured cold path

Question 5

Which metric is the best predictor of the storage needed for an indexer in a cluster?

Accepted Answer

Daily ingestion volume. Daily ingestion volume is the primary driver for capacity planning.

Answer

Number of forwarders

Answer

Search concurrency

Answer

Number of users

Question 6

What is the purpose of the 'homePath.maxDataSizeMB' setting in indexes.conf?

Accepted Answer

Limits the total size of all hot/warm buckets in the homePath. It restricts the total size of the homePath directory, which forces bucket rotation if exceeded.

Answer

Sets the maximum size of a single hot bucket

Answer

Limits the number of buckets to 100

Answer

Sets the size limit for the cold path

Question 7

In a SmartStore architecture, what happens when a bucket is evicted from local cache?

Accepted Answer

The local disk space is freed. In SmartStore, eviction removes the copy from the indexer's local disk, but the bucket persists in remote object storage.

Answer

The bucket is moved to the cold path

Answer

The bucket is no longer searchable

Answer

The bucket is deleted from remote storage

Question 8

A user wants to restore data from frozen buckets. What is the process for making this data searchable again?

Accepted Answer

Copy to the thawedPath and use the 'rebuild' command. The data must be thawed by copying the bucket to the thawed directory and restarting/triggering a refresh.

Answer

Directly copy files to the warm path

Answer

Change the frozenTimePeriodInSecs

Answer

Run 'splunk restore --bucket'

Question 9

Which configuration file and stanza are used to define the bucket lifecycle policy for a custom index named 'customer_data'?

Accepted Answer

indexes.conf [customer_data]. indexes.conf is the standard file where index-specific lifecycle settings are defined.

Answer

datamodels.conf [customer_data]

Answer

server.conf [customer_data]

Answer

inputs.conf [customer_data]

Question 10

You need to reduce the number of small buckets created in your index. Which parameter should you increase?

Accepted Answer

maxDataSize. Increasing maxDataSize increases the size of each bucket, thereby reducing the total count of buckets.

Answer

maxWarmDBCount

Answer

frozenTimePeriodInSecs

Answer

minHotBuckets

Question 11

Which bucket state is considered read-only but still resides on high-performance storage?

Accepted Answer

Warm. Warm buckets are read-only (once closed) and reside on high-performance storage.

Answer

Frozen

Answer

Hot

Answer

Cold

Question 12

Which TWO of the following are valid bucket states in the Splunk index lifecycle?

Accepted Answer

Hot. Hot, Warm, Cold, and Frozen are the standard lifecycle states.

Answer

Active

Answer

Pending

Answer

System

Question 13

An architect is designing an index lifecycle for compliance. The requirement is to keep data for exactly 7 years. Which setting must be configured to prevent premature deletion?

Accepted Answer

frozenTimePeriodInSecs. frozenTimePeriodInSecs must be set to the equivalent of 7 years in seconds.

Answer

maxTotalDataSizeMB

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Question 14

Which THREE factors influence the disk I/O performance of an indexer cluster?

Accepted Answer

Search concurrency. Disk I/O is impacted by ingestion rate, search concurrency, and the type of storage used (e.g., SSD vs HDD).

Answer

Deployment server latency

Answer

Number of users logged in

Question 15

Which TWO of these are valid methods for controlling bucket retention?

Accepted Answer

maxTotalDataSizeMB. Retention is controlled by time or size (total disk space).

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Answer

index_auto_delete