SPLK-2002 Data Lifecycle Management — Timed 10 Questions

Question 1

You are troubleshooting a performance issue where cold buckets are being moved to frozen storage too slowly. You find that the indexer is saturated with I/O operations. Which setting can be used to throttle the migration of cold buckets to frozen to improve system responsiveness?

10 minute time limit — choose an answer to begin.

Accepted Answer

coldToFrozenScript. There is no native 'throttle' setting for bucket freezing; however, the correct architectural approach for bucket lifecycle management often involves offloading the freezing process or managing throughput through indexer settings.

Answer

maxHotBuckets

Answer

rotatePeriodInSecs

Answer

maxTotalDataSizeMB

Question 2

An architect needs to implement a data retention policy that keeps data for 30 days in hot/warm and then moves it to cold storage for 60 days before deletion. Which attribute in indexes.conf controls the transition from warm to cold?

Accepted Answer

maxWarmDBCount. The homePath.maxDataSize is for sizing, but the movement of buckets is controlled by the MaxHotSpanSecs or more directly the frozenTimePeriodInSecs for deletion, while warm/cold transition is determined by the maxWarmDBCount or maxTotalDataSizeMB.

Answer

frozenTimePeriodInSecs

Answer

maxHotSpanSecs

Answer

coldPath.maxDataSizeMB

Question 3

Which command would you use to verify the current bucket status and size on a Splunk indexer?

Accepted Answer

splunk list buckets. splunk cmd splunkd bucket-info is a valid tool, but standard CLI is 'splunk show-buckets' or inspecting the filesystem.

Answer

splunk inspect data

Answer

splunk show-indexes

Answer

splunk check-storage

Question 4

Which setting in 'indexes.conf' controls the total amount of disk space occupied by the 'warm' buckets for a specific index?

Accepted Answer

maxWarmDBCount. maxWarmDBCount or maxTotalDataSizeMB are the standard ways to limit bucket growth.

Answer

maxDataSize

Answer

coldPath.maxDataSizeMB

Answer

maxHotSpanSecs

Question 5

When planning storage, which file type within an index bucket contains the actual raw log data?

Accepted Answer

journal.gz. The journal.gz file contains the compressed raw data.

Answer

rawdata

Answer

tsidx

Answer

meta

Question 6

Which TWO directories are typically found inside a Splunk bucket?

Accepted Answer

rawdata. Splunk buckets contain data files (journal.gz) and metadata/index files (tsidx).

Answer

configs

Answer

apps

Answer

logs

Question 7

A Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio. If the raw data volume doubles, how should the retention period be modified to maintain the original storage footprint?

Accepted Answer

Decrease retention to 15 days. If volume doubles (1000GB/day) and storage space must remain constant, the retention must be halved (15 days) to keep the total stored data volume equivalent.

Answer

Keep retention at 30 days

Answer

Decrease retention to 7 days

Answer

Increase retention to 60 days

Question 8

A Splunk architect notices that Data Model Acceleration summaries are consuming excessive disk space. Which configuration setting in datamodels.conf should be adjusted to limit the storage impact of these summaries?

Accepted Answer

acceleration.max_time. acceleration.max_time defines the retention period for the accelerated summaries.

Answer

acceleration.earliest_time

Answer

acceleration.backfill

Answer

acceleration.cron_schedule

Question 9

A large-scale Splunk deployment is experiencing 'bucket rolling' latency. Upon investigation, you determine that the indexer is waiting for the indexer cluster manager to acknowledge the bucket status. Which indexer clustering setting directly impacts the speed of bucket replication during the rolling process?

Accepted Answer

max_replication_streams. replication_factor impacts the number of copies, but the throughput of bucket replication is managed by the replication queue settings.

Answer

search_factor

Answer

service_interval

Answer

heartbeat_timeout

Question 10

In a multisite indexer cluster, a bucket with replication factor 3 has its primary copy in Site 1 and secondary copies in Site 2. A network partition occurs. Which setting determines if the indexer will accept new data if it cannot reach the Site 2 indexers?

Accepted Answer

site_replication_factor. site_replication_factor determines the behavior for bucket replication across sites.

Answer

min_replication_factor

Answer

search_factor_per_site

Answer

cluster_replication_queue