SPLK-2002 Deployment Architecture And Clustering — 10 Questions

Question 1

A Search Head Cluster (SHC) is experiencing frequent 'captain election' issues during high-load periods. Upon reviewing the logs, you notice network latency spikes between nodes. Which parameter in the SHC configuration should be adjusted to allow for more tolerance in node communication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

heartbeat_timeout. In a Search Head Cluster, the captain is elected and maintained via heartbeat messages between members. The 'heartbeat_timeout' setting defines how long a member waits before considering another member unreachable. Raising it tolerates longer network latency spikes without triggering unnecessary captain elections.

Answer

election_timeout

Answer

replication_factor

Answer

search_timeout

Question 2

In an Indexer Cluster, you want to perform a rolling restart to update the configuration. Which CLI command ensures that the rolling restart happens only after the indexer cluster has reached a state of 'Complete' synchronization?

Accepted Answer

splunk rolling-restart cluster-peers. The 'splunk rolling-restart cluster-peers' command allows for wait-related flags, but specifically, one must ensure the cluster is ready before initiating the rolling process to prevent data loss or search degradation.

Answer

splunk apply cluster-bundle --force

Answer

splunk rolling-restart cluster-peers --check-status

Answer

splunk restart indexer

Question 3

You are managing a large Indexer Cluster and need to reduce the time it takes for a new node to catch up. Which setting allows you to limit the amount of bandwidth used during bucket replication?

Accepted Answer

replication_throttle. The 'replication_throttling' setting in server.conf allows for control over the network bandwidth used for bucket replication, preventing saturation.

Answer

cluster_bandwidth_control

Answer

bandwidth_limit

Answer

max_replication_speed

Question 4

You are designing an Indexer Cluster with three sites. To ensure data availability during a site failure, you have configured multisite replication. Which setting must be explicitly defined in server.conf on the cluster master to ensure that buckets are replicated across sites according to your policy?

Accepted Answer

multisite_replication_factor. In a multisite indexer cluster, the cluster master uses multisite_replication_factor in server.conf to define how many copies of each bucket must exist across sites (expressed as site:count pairs, e.g., site1:2,site2:1). This is distinct from the standard replication_factor, which governs total copies within a site. Without explicitly setting multisite_replication_factor, the cluster cannot enforce cross-site replication policy and site-failure availability is not guaranteed.

Answer

replication_factor

Answer

site_replication_policy

Answer

cluster_replication_mode

Question 5

Which component is responsible for communicating with the License Master to verify indexer entitlements in an Indexer Cluster?

Accepted Answer

Indexer Peer. Every peer node in an indexer cluster must communicate directly with the License Master.

Answer

Deployment Server

Answer

Search Head

Answer

Cluster Master

Question 6

When configuring a Search Head Cluster, what is the purpose of the 'deployer'?

Accepted Answer

To manage the replication of search configurations. The deployer is a standalone Splunk instance that distributes apps, configurations, and knowledge objects (like saved searches, lookups, and field extractions) to all members of a Search Head Cluster. It pushes the replicated configuration bundle to the cluster, and the captain then handles distributing it to members. The deployer does not participate in search, captain election, or user load balancing.

Answer

To coordinate the election of the captain

Answer

To act as a load balancer for users

Answer

To store the search results for the cluster

Question 7

In a multisite indexer cluster, what does the 'site' designation in server.conf specifically control?

Accepted Answer

The replication policy and bucket placement. In a Splunk multisite indexer cluster, the site designation in server.conf (under the [general] stanza) defines which site an indexer belongs to. This directly controls the cluster's replication and search factor policies, as well as bucket placement and replication across sites. The site value is used by the cluster master to enforce multisite replication rules, such as origin site replication and total site replication, ensuring data redundancy and search affinity.

Answer

The load balancing algorithm

Answer

The user access rights

Answer

The search head affinity

Question 8

When configuring a Search Head Cluster, what is the best practice for managing the 'shcluster-bundle' directory?

Accepted Answer

Version control the bundle in a separate directory. The `shcluster-bundle` directory contains the configuration bundle that the captain pushes to members. Best practice is to version control this bundle in a separate directory (e.g., using Git) to track changes, enable rollback, and maintain an audit trail. This ensures that configuration changes are managed systematically and can be reverted if needed.

Answer

Delete it after every deployment

Answer

Keep it in the /opt/splunk/etc/system/local directory

Answer

Automatically sync it to the Cluster Master

Question 9

A customer needs to decommission a single indexer peer from an Indexer Cluster without losing data. Which step is mandatory to ensure all data is safely migrated to other peers?

Accepted Answer

Run 'splunk remove cluster-peers' on the CM. To safely decommission an indexer peer from a Splunk indexer cluster, you must run 'splunk remove cluster-peers' on the cluster master (or use the equivalent offline command) so the master can reassign the peer's buckets to other peers and maintain replication and search factors. Simply shutting down the peer risks under-replication and data loss if other copies fail.

Answer

Force a cluster bundle update

Answer

Delete the indexer directory on the CM

Answer

Simply shut down the indexer service

Question 10

You notice that your indexer cluster has buckets in a 'Searchable' state but some are marked as 'Streaming'. What does this indicate?

Accepted Answer

Bucket replication is in progress to other peers. In an indexer cluster, a bucket marked 'Streaming' alongside 'Searchable' indicates that the bucket is currently being replicated to other peer nodes to satisfy the replication_factor. The 'Searchable' state means the bucket is available for search on at least one peer, while 'Streaming' means replication is actively in progress. Once replication completes, the Streaming flag clears.

Answer

The bucket is corrupt

Answer

The indexer is performing a hot-to-warm rollover

Answer

The data is being archived to cold storage