SPLK-2002 High Availability And Distributed Search — Timed 10 Questions

Question 1

A customer is experiencing 'Search peer [peer-name] is not responding' errors during indexer maintenance. Which configuration parameter in server.conf should be tuned to prevent search failures during rolling restarts?

10 minute time limit — choose an answer to begin.

Accepted Answer

restart_timeout. The 'restart_timeout' parameter in the [clustering] stanza controls how long a search head waits for a peer to return before marking it as down during a rolling restart.

Answer

peer_down_timeout

Answer

max_search_time

Answer

heartbeat_timeout

Answer

search_retry_timeout

Question 2

Which component in a distributed search environment is responsible for the 'Search Affinity' feature?

Accepted Answer

Search Head. Search Affinity is a Search Head feature that ensures a search dispatched to an indexer cluster is routed to the same peer that holds the replicated bucket, minimizing cross-network data transfer. The Search Head (specifically the search head's cluster master integration) manages this routing decision.

Answer

Deployment Server

Answer

License Master

Answer

Indexer Peer

Answer

Cluster Master

Question 3

You need to migrate a single-site Indexer Cluster to a multi-site configuration. What is the first step you must perform before modifying the server.conf on the Cluster Master?

Accepted Answer

Set the cluster to maintenance_mode=true.. Before changing the cluster master's server.conf to convert a single-site cluster to multisite, you must set the cluster to maintenance mode (maintenance_mode=true) so the master does not attempt fixup or rebalance while the topology is being reconfigured. This prevents the master from reacting to the site changes mid-edit and creating unnecessary bucket replication churn. After the change and restart, you exit maintenance mode and the master applies the new multisite factors.

Answer

Delete all existing buckets.

Answer

Configure the site-specific replication factors.

Answer

Upgrade the license server.

Answer

Disable all forwarder data ingestion.

Question 4

You are designing a multi-site Indexer Cluster with two sites. To ensure search availability during a site failure, which configuration is mandatory in the site_replication_factor stanza of server.conf?

Accepted Answer

Define explicit replication counts for each site using 'siteN' syntax.. In a multi-site indexer cluster, the site_replication_factor attribute in server.conf must use explicit per-site syntax (e.g., 'origin:2, total:3' or 'site1:2, site2:2, total:4') to define how many copies of each bucket exist at each site. This explicit siteN syntax is mandatory because it ensures that search availability survives a full site failure by guaranteeing replicas exist at each site. Without per-site counts, Splunk cannot enforce site-aware replication.

Answer

Enable search_factor to 2 for all sites.

Answer

Set replication_factor to 1 on each site.

Answer

Set cluster_mode to 'multisite_master'.

Answer

Configure the indexer as a site-local peer.

Question 5

When configuring a Search Head Cluster, which of the following is true regarding the 'shcluster_replication_port'?

Accepted Answer

It must be configured in server.conf.. The `shcluster_replication_port` is a setting in the `[shclustering]` stanza of server.conf that specifies the port used for replication traffic between search head cluster members. It must be configured in server.conf on each member, typically with the same value across the cluster (default 9887).

Answer

It must be different for every member.

Answer

It is only used by the captain.

Answer

It is used for forwarding data.

Answer

It is automatically detected by the Cluster Master.

Question 6

In a disaster recovery scenario, which file must be restored to a new Cluster Master to ensure it recognizes the existing indexer peers?

Accepted Answer

server.conf. The `server.conf` file contains the `[clustering]` stanza with the cluster master's configuration, including the `pass4SymmKey` (Cluster Secret) and the list of peer nodes. Restoring this file to a new Cluster Master ensures it can authenticate and recognize existing indexer peers, allowing the cluster to resume operations.

Answer

inputs.conf

Answer

distsearch.conf

Answer

props.conf

Answer

indexes.conf

Question 7

Which feature ensures that Search Head Cluster members share knowledge objects like saved searches and reports?

Accepted Answer

Search Head Cluster replication. Search Head Cluster replication is the mechanism that synchronizes knowledge objects (saved searches, reports, dashboards, etc.) across all members of a Search Head Cluster. It uses a replication factor to ensure that each artifact is copied to multiple members, providing both redundancy and consistency. This allows any search head in the cluster to serve the same user-created content, which is essential for a unified search experience.

Answer

Cluster Master

Answer

Index-time extraction

Answer

Bucket replication

Answer

Deployment Server

Question 8

You want to perform a rolling restart of an Indexer Cluster without stopping ingestion. What configuration ensures that indexers remain available?

Accepted Answer

Set 'restart_mode=rolling'.. A rolling restart in an Indexer Cluster is initiated by setting the restart_mode to rolling (e.g., via the CLI 'splunk rolling-restart cluster-peers' or by setting restart_mode=rolling in server.conf on the cluster master). This ensures that indexers are restarted one at a time (or in batches) while maintaining replication and searchability, so ingestion continues without interruption. The cluster master orchestrates the restart, waiting for buckets to be replicated before proceeding.

Answer

Disable the indexer peers.

Answer

Stop the Cluster Master first.

Answer

Restart all indexers at once.

Answer

Set 'replication_factor=1'.

Question 9

In a multisite cluster, how does the 'site_replication_factor' override the global 'replication_factor'?

Accepted Answer

It defines the total number of copies per site.. In a Splunk multisite cluster, the global replication_factor sets the total number of copies across all sites, but site_replication_factor overrides this by specifying exactly how many copies must exist per site. For example, site_replication_factor = origin:2, total:3 means each site must have at least 2 copies (origin site) and the cluster must maintain 3 total copies. This ensures data redundancy and availability even if an entire site fails, as each site independently satisfies its replication requirement.

Answer

It only applies to the primary site.

Answer

It ignores the search factor.

Answer

It is used for load balancing.

Answer

It is only used when the CM is down.

Question 10

When migrating to a Search Head Cluster, what happens to existing saved searches that were defined in local/savedsearches.conf on a standalone search head?

Accepted Answer

They are ignored by the cluster.. These need to be manually migrated into the 'shcluster' application directory to be recognized by the new cluster.

Answer

They are automatically migrated by the cluster.

Answer

They are deleted by the captain.

Answer

They are replicated to all members automatically.

Answer

They cause a cluster startup error.