SPLK-2002 High Availability And Distributed Search — 20 Questions

Question 1

When migrating to a Search Head Cluster, what happens to existing saved searches that were defined in local/savedsearches.conf on a standalone search head?

Accepted Answer

They are ignored by the cluster.. These need to be manually migrated into the 'shcluster' application directory to be recognized by the new cluster.

Answer

They are automatically migrated by the cluster.

Answer

They are deleted by the captain.

Answer

They are replicated to all members automatically.

Answer

They cause a cluster startup error.

Question 2

In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?

Accepted Answer

Maintaining the bucket registry and managing replication status.. The CM assigns bucket IDs and manages bucket replication/searchability across peers, but it does not store the raw indexed data itself.

Answer

Directing search requests to specific indexers.

Answer

Indexing incoming forwarder data.

Answer

Storing raw data and serving search requests.

Answer

Aggregating search results from indexers.

Question 3

If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?

Accepted Answer

2. The search factor determines how many copies of a bucket are searchable. If search_factor is 2, the cluster ensures at least two copies are available for searching.

Answer

5

Answer

4

Answer

1

Answer

3

Question 4

A customer is experiencing 'Search peer [peer-name] is not responding' errors during indexer maintenance. Which configuration parameter in server.conf should be tuned to prevent search failures during rolling restarts?

Accepted Answer

restart_timeout. The 'restart_timeout' parameter in the [clustering] stanza controls how long a search head waits for a peer to return before marking it as down during a rolling restart.

Answer

peer_down_timeout

Answer

max_search_time

Answer

heartbeat_timeout

Answer

search_retry_timeout

Question 5

Which component in a distributed search environment is responsible for the 'Search Affinity' feature?

Accepted Answer

Search Head. Search affinity allows a Search Head to prefer indexers within the same site, reducing cross-site bandwidth usage.

Answer

Deployment Server

Answer

License Master

Answer

Indexer Peer

Answer

Cluster Master

Question 6

When using a Search Head Cluster, what is the purpose of the 'captain'?

Accepted Answer

To coordinate search scheduling and replicate configuration bundles.. The captain manages the search head cluster's configuration, coordinates job scheduling, and maintains the cluster state.

Answer

To act as the Cluster Master for indexers.

Answer

To store all bucket data for the indexers.

Answer

To receive data from forwarders.

Answer

To distribute search results to the end user.

Question 7

What happens to a search job if the Search Head Cluster captain goes down during an active search?

Accepted Answer

A new captain is elected and search jobs are recovered.. The cluster will elect a new captain, and the search job will typically resume or be re-dispatched by the new captain depending on the state of the job.

Answer

The search head cluster becomes read-only.

Answer

Indexers stop processing data.

Answer

The entire cluster must be restarted.

Answer

The search job is canceled immediately.

Question 8

You need to migrate a single-site Indexer Cluster to a multi-site configuration. What is the first step you must perform before modifying the server.conf on the Cluster Master?

Accepted Answer

Set the cluster to maintenance_mode=true.. You must put the cluster into maintenance mode to prevent the CM from attempting to rebalance buckets or trigger replication while you are actively reconfiguring the site topology.

Answer

Delete all existing buckets.

Answer

Configure the site-specific replication factors.

Answer

Upgrade the license server.

Answer

Disable all forwarder data ingestion.

Question 9

You are designing a multi-site Indexer Cluster with two sites. To ensure search availability during a site failure, which configuration is mandatory in the site_replication_factor stanza of server.conf?

Accepted Answer

Define explicit replication counts for each site using 'siteN' syntax.. In a multi-site cluster, the total replication factor must be the sum of site-specific replication factors, and each site must be explicitly defined to ensure data is distributed across sites.

Answer

Enable search_factor to 2 for all sites.

Answer

Set replication_factor to 1 on each site.

Answer

Set cluster_mode to 'multisite_master'.

Answer

Configure the indexer as a site-local peer.

Question 10

When configuring a Search Head Cluster, which of the following is true regarding the 'shcluster_replication_port'?

Accepted Answer

It must be configured in server.conf.. The replication port is used by SHC members to sync configuration changes, job results, and knowledge objects, and must be open on all members.

Answer

It must be different for every member.

Answer

It is only used by the captain.

Answer

It is used for forwarding data.

Answer

It is automatically detected by the Cluster Master.

Question 11

You notice that your indexer cluster has 'Streaming' buckets that are not yet searchable. What is the most likely cause?

Accepted Answer

The search factor is not met for these buckets.. Streaming buckets are warm/cold buckets that are currently being replicated; if they aren't searchable, it indicates the search factor has not yet been satisfied for those buckets.

Answer

The indexer is in maintenance mode.

Answer

The indexer disk is full.

Answer

The license is expired.

Answer

The Cluster Master is down.

Question 12

Which command is used to check the health of an Indexer Cluster from the Cluster Master CLI?

Accepted Answer

splunk show cluster-status. The 'splunk show cluster-status' command provides a summary of peer health, bucket status, and replication metrics.

Answer

splunk cluster-check

Answer

splunk inspect-cluster

Answer

splunk search-peers

Answer

splunk list indexers

Question 13

In a disaster recovery scenario, which file must be restored to a new Cluster Master to ensure it recognizes the existing indexer peers?

Accepted Answer

server.conf. The 'server.conf' (containing the cluster secret and configuration) and the 'master-apps' directory are crucial for restoring a CM's knowledge of the cluster.

Answer

inputs.conf

Answer

distsearch.conf

Answer

props.conf

Answer

indexes.conf

Question 14

When configuring search affinity for a multi-site cluster, what is the behavior if no indexers are available in the local site?

Accepted Answer

The search head queries indexers in other sites.. By default, the search head will fallback to searching indexers in other sites if the local site is unavailable, ensuring search results are still retrieved.

Answer

The search fails immediately.

Answer

The search head waits for the local indexer to return.

Answer

The search head only returns partial results.

Answer

The search head reports an error to the user.

Question 15

What is the recommended method to distribute configuration changes across a Search Head Cluster?

Accepted Answer

Using the 'splunk apply shcluster-bundle' command.. The 'splunk apply shcluster-bundle' command is the only supported method for pushing configuration updates to SHC members.

Answer

Using the Deployment Server.

Answer

Updating the captain only.

Answer

Manual file copying to each node.

Answer

Using a shared network drive.

Question 16

What is the recommended way to handle an indexer peer that is permanently failing in an Indexer Cluster?

Accepted Answer

Use the 'splunk offline' command on the peer.. You should use the 'splunk offline' command to gracefully remove the peer, allowing the cluster to re-replicate the missing data to other healthy peers.

Answer

Ignore the peer and wait for timeout.

Answer

Delete the indexer's data directory manually.

Answer

Update the master node configuration.

Answer

Shutdown the service without notice.

Question 17

Which feature ensures that Search Head Cluster members share knowledge objects like saved searches and reports?

Accepted Answer

Search Head Cluster replication. Search Head Cluster members synchronize knowledge objects automatically using the replication service configured on the replication port.

Answer

Cluster Master

Answer

Index-time extraction

Answer

Bucket replication

Answer

Deployment Server

Question 18

You want to perform a rolling restart of an Indexer Cluster without stopping ingestion. What configuration ensures that indexers remain available?

Accepted Answer

Set 'restart_mode=rolling'.. The rolling restart mechanism automatically manages peer availability, but you should also ensure your forwarders are configured with indexing-side load balancing.

Answer

Disable the indexer peers.

Answer

Stop the Cluster Master first.

Answer

Restart all indexers at once.

Answer

Set 'replication_factor=1'.

Question 19

When adding a new indexer to an existing Indexer Cluster, what is the best practice to ensure the indexer is ready before it starts receiving data?

Accepted Answer

Start the splunk service and wait for the CM to acknowledge registration.. New peers must register with the Cluster Master and receive the latest configuration bundle before they can participate in indexing.

Answer

Set the indexer to maintenance mode.

Answer

Manually copy index buckets from other peers.

Answer

Restart all existing peers.

Answer

Add the indexer to the indexer discovery list.

Question 20

Which type of bucket is used for the most recent data and is generally searchable?

Accepted Answer

Hot. Hot buckets are where data is currently being ingested and they are always searchable.

Answer

Warm

Answer

Cold

Answer

Frozen

Answer

Thawed