SPLK-2002 Deployment Architecture And Clustering — 20 Questions

Question 1

In an Indexer Cluster, you want to perform a rolling restart to update the configuration. Which CLI command ensures that the rolling restart happens only after the indexer cluster has reached a state of 'Complete' synchronization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

splunk rolling-restart cluster-peers. The 'splunk rolling-restart cluster-peers' command allows for wait-related flags, but specifically, one must ensure the cluster is ready before initiating the rolling process to prevent data loss or search degradation.

Answer

splunk apply cluster-bundle --force

Answer

splunk rolling-restart cluster-peers --check-status

Answer

splunk restart indexer

Question 2

You are managing a large Indexer Cluster and need to reduce the time it takes for a new node to catch up. Which setting allows you to limit the amount of bandwidth used during bucket replication?

Accepted Answer

replication_throttle. The 'replication_throttling' setting in server.conf allows for control over the network bandwidth used for bucket replication, preventing saturation.

Answer

cluster_bandwidth_control

Answer

bandwidth_limit

Answer

max_replication_speed

Question 3

Which component is responsible for communicating with the License Master to verify indexer entitlements in an Indexer Cluster?

Accepted Answer

Indexer Peer. Every peer node in an indexer cluster must communicate directly with the License Master.

Answer

Deployment Server

Answer

Search Head

Answer

Cluster Master

Question 4

Which setting in server.conf on the Cluster Master prevents buckets from being replicated to peers that have been offline for a specific amount of time?

Accepted Answer

rep_max_offline_time. The 'stale_bucket_threshold' or similar replication settings help ensure that the cluster does not attempt to replicate data to long-dead nodes.

Answer

max_peer_offline_time

Answer

bucket_expiry_time

Answer

cluster_peer_timeout

Question 5

Which TWO of the following are necessary prerequisites for configuring an Indexer Cluster?

Accepted Answer

Unique server names for every peer. All indexer peers must have the same server name if they are to be uniquely identified, and they must communicate with the CM using the same security key.

Answer

A dedicated license master

Answer

A dedicated load balancer for ingestion

Answer

A shared storage array for all peers

Question 6

When planning a deployment, which component is required to act as the primary communication hub for managing configuration bundles in an Indexer Cluster?

Accepted Answer

Cluster Master. The Cluster Master (CM) manages the configuration bundles that are pushed to all indexer peers in the cluster.

Answer

License Master

Answer

Deployment Server

Answer

Search Head

Question 7

You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?

Accepted Answer

Use the local/ directory for configuration files that should not be replicated. Local configurations should be placed in the 'local' directory of the application, which is ignored by the SHC replication process for cluster-wide bundles.

Answer

Move files to the var/run directory

Answer

Set the configuration to immutable in server.conf

Answer

Use the shcluster/ directory

Question 8

A Search Head Cluster (SHC) is experiencing frequent 'captain election' issues during high-load periods. Upon reviewing the logs, you notice network latency spikes between nodes. Which parameter in the SHC configuration should be adjusted to allow for more tolerance in node communication?

Accepted Answer

heartbeat_timeout. The heartbeat_timeout setting in the SHC configuration controls how long a node can go without a heartbeat before it is considered down, which can be increased to mitigate network latency issues.

Answer

election_timeout

Answer

replication_factor

Answer

search_timeout

Question 9

When implementing a multisite indexer cluster, what happens if the cluster master becomes unreachable for a short duration?

Accepted Answer

Indexer peers continue to accept and index data. In an indexer cluster, search heads and indexer peers can continue to operate and process data even if the CM is offline, though bucket replication might be paused.

Answer

All indexing stops immediately

Answer

Search heads stop returning results

Answer

Data replication across sites is forced immediately

Question 10

You are designing an Indexer Cluster with three sites. To ensure data availability during a site failure, you have configured multisite replication. Which setting must be explicitly defined in server.conf on the cluster master to ensure that buckets are replicated across sites according to your policy?

Accepted Answer

multisite_replication_factor. The multisite_replication_factor in server.conf determines how many copies of a bucket are kept and across which sites, which is essential for multisite cluster data integrity.

Answer

replication_factor

Answer

site_replication_policy

Answer

cluster_replication_mode

Question 11

When configuring a Search Head Cluster, what is the purpose of the 'deployer'?

Accepted Answer

To manage the replication of search configurations. The deployer is used to distribute configuration bundles (apps) to all search heads in the cluster.

Answer

To coordinate the election of the captain

Answer

To act as a load balancer for users

Answer

To store the search results for the cluster

Question 12

Which component in an Indexer Cluster is responsible for assigning buckets to peers?

Accepted Answer

The Cluster Master. The Cluster Master (CM) manages the mapping of buckets to peer nodes.

Answer

The Search Head

Answer

The indexer peer itself

Answer

The Deployment Server

Question 13

In a multisite indexer cluster, what does the 'site' designation in server.conf specifically control?

Accepted Answer

The replication policy and bucket placement. The site designation determines which data replication policies are applied to the bucket copies based on the physical location of the indexer.

Answer

The load balancing algorithm

Answer

The user access rights

Answer

The search head affinity

Question 14

You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?

Accepted Answer

Search affinity. Search affinity allows you to configure search heads to prioritize indexers within their own site to minimize cross-site traffic.

Answer

Site-aware routing

Answer

Data locality

Answer

Load balancing

Question 15

When configuring a Search Head Cluster, what is the best practice for managing the 'shcluster-bundle' directory?

Accepted Answer

Version control the bundle in a separate directory. The 'shcluster-bundle' directory should be kept in a version control system (like Git) to ensure configuration changes can be tracked and reverted.

Answer

Delete it after every deployment

Answer

Keep it in the /opt/splunk/etc/system/local directory

Answer

Automatically sync it to the Cluster Master

Question 16

A customer needs to decommission a single indexer peer from an Indexer Cluster without losing data. Which step is mandatory to ensure all data is safely migrated to other peers?

Accepted Answer

Run 'splunk remove cluster-peers' on the CM. Putting the indexer into 'maintenance_mode' or using the 'splunk remove cluster-peers' command allows the cluster to redistribute buckets.

Answer

Force a cluster bundle update

Answer

Delete the indexer directory on the CM

Answer

Simply shut down the indexer service

Question 17

You notice that your indexer cluster has buckets in a 'Searchable' state but some are marked as 'Streaming'. What does this indicate?

Accepted Answer

Bucket replication is in progress to other peers. Streaming buckets are typically related to the replication of data from a primary to a secondary node; if they stay in this state, it may indicate replication lag.

Answer

The bucket is corrupt

Answer

The indexer is performing a hot-to-warm rollover

Answer

The data is being archived to cold storage

Question 18

What is the primary function of the 'search_factor' in an indexer cluster?

Accepted Answer

The number of searchable copies of each bucket. The search_factor dictates how many copies of the searchable data are maintained in the cluster to ensure high availability for search queries.

Answer

The maximum number of concurrent searches

Answer

The number of indexer peers in the cluster

Answer

The number of search heads allowed in the cluster

Question 19

A new indexer is added to a cluster. How does the cluster handle the historical data that already exists on other indexers?

Accepted Answer

The cluster redistributes buckets only if necessary to meet factors. Existing data is not automatically replicated to the new node unless it is required to satisfy the replication factor or search factor settings.

Answer

The new node only receives new data

Answer

The cluster forces a reindex of all historical data

Answer

All historical data is immediately copied to the new node

Question 20

When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?

Accepted Answer

To define the number of copies of search artifacts. In an SHC, the replication_factor defines how many copies of the search-related configurations are replicated across members.

Answer

To limit the number of users

Answer

To specify the number of search nodes in the cluster

Answer

To balance the search load across nodes