SPLK-2002 Performance Tuning — 20 Questions

Question 1

You are tuning a Splunk heavy forwarder. The 'parsingQueue' is consistently full. Which configuration change in props.conf or inputs.conf is recommended?

Accepted Answer

Increase the 'maxQueueSize' for the parsing queue in limits.conf. The parsing queue is typically blocked by complex regex transformations or heavy parsing loads. Adjusting pipeline settings or splitting the workload across more CPUs is necessary.

Answer

Reduce the number of indexers in the output group

Answer

Disable 'sourcetype' auto-discovery

Question 2

When using Data Model acceleration, which setting should be monitored to ensure the background summary search does not starve other searches of resources?

Accepted Answer

accelerated_search_max_threads. The 'tstats_max_search_time' or similar limits in limits.conf manage how long these accelerated searches run, but the 'accelerated_search_max_threads' setting controls the concurrency.

Answer

summary_index_concurrency

Answer

max_summary_size

Answer

data_model_memory_limit

Question 3

You are configuring a heavy forwarder to filter data before sending it to indexers. Which stanza in props.conf is used to define the filtering criteria?

Accepted Answer

[sourcetype::*]. Filtering is performed using the 'TRANSFORMS' attribute in props.conf, which points to a stanza in transforms.conf.

Answer

[FILTER]

Answer

[OUTPUT]

Answer

[FORWARDER]

Question 4

Which TWO settings in limits.conf are used to control search concurrency for roles?

Accepted Answer

max_searches_per_user (authorize.conf). The 'max_searches_per_user' and 'max_searches_per_role' define concurrency limits per entity in authorize.conf, but limits.conf has general concurrency settings. Actually, these are primarily in authorize.conf. Wait, which TWO?

Answer

max_search_concurrency (limits.conf)

Answer

search_concurrency (limits.conf)

Answer

max_concurrent_searches (server.conf)

Question 5

A Splunk administrator needs to identify why a specific search is experiencing high 'Disk Read' wait times. Which tool or log source should be utilized to correlate search IDs with specific disk latency metrics?

Accepted Answer

Audit logs correlated with indexer metrics via the Monitoring Console. The _internal index contains the audit.log and search-activity metadata which, when correlated with OS-level metrics (e.g., via Splunk_TA_nix), provides visibility into disk I/O bottlenecks.

Answer

Search Inspector

Answer

Splunk Web UI Performance Monitor

Answer

splunkd.log

Question 6

When managing indexer clustering, what is the impact of a high 'replication_factor' on indexing performance?

Accepted Answer

Increases indexing latency due to synchronous replication requirements. Increasing the replication factor increases the write overhead on indexers because each event must be replicated to multiple peers, increasing network and disk I/O.

Answer

Allows for faster data ingestion without resource constraints

Answer

Improves search speed by reducing data density

Answer

Decreases indexer storage requirements

Question 7

Which dashboard in the Monitoring Console provides the best overview of resource consumption per search head?

Accepted Answer

Search Head Activity. The 'Search Head Activity' dashboard provides resource usage details specific to search heads.

Answer

Data Ingestion Performance

Answer

Resource Usage: Forwarders

Answer

Indexer Activity

Question 8

Which setting in indexes.conf should be tuned to balance memory usage and indexing speed for a high-volume indexer?

Accepted Answer

maxDataSize. maxDataSize determines the size of the TSIDX files before rolling, which impacts how often the indexer performs merge operations.

Answer

hot_bucket_count

Answer

io_priority

Answer

block_size

Question 9

You are analyzing search performance using the Search Activity dashboard. You observe that 'Result Count' is extremely high for a specific saved search. Which optimization technique is most effective to reduce the load on the indexer?

Accepted Answer

Use specific time ranges and selective filters at the beginning of the search. Adding selective filtering using indexed fields at the start of the search minimizes the amount of data read from disk.

Answer

Increase the memory allocation for the search head

Answer

Disable data model acceleration for the index

Answer

Use the | table command at the start

Question 10

An administrator notices that searches are slow due to high CPU utilization on indexers. Which configuration change in limits.conf directly controls the maximum number of concurrent searches allowed on an indexer?

Accepted Answer

max_searches_per_cpu. The max_searches_per_cpu setting in limits.conf defines the maximum number of concurrent searches allowed per CPU core on an indexer.

Answer

concurrent_search_limit

Answer

base_max_searches

Answer

max_searches

Question 11

A user complains that a search is slow despite having a small time range. The Search Inspector reveals 'event_count' is high, but 'scanned_count' is also high. What is the likely cause?

Accepted Answer

The search is not using an indexed field to filter data. If the scanned count is much higher than the event count, the search is reading too much data from disk because it is not effectively filtering by indexed fields (e.g., using terms that are not indexed).

Answer

The indexer has too much memory

Answer

Data model acceleration is failing

Answer

The search head is underpowered

Question 12

When performance tuning the 'Splunk Web' interface for users, which configuration helps manage the 'Search Results' cache?

Accepted Answer

cache_results in limits.conf. The 'cache_results' setting in limits.conf controls how long or if search results are cached for future use.

Answer

results_ttl in server.conf

Answer

max_results_cache in authorize.conf

Answer

web_cache_size in web.conf

Question 13

Which Splunk component is responsible for receiving data from forwarders and distributing it to the correct indexers?

Accepted Answer

Indexer. An indexer cluster node or a load balancer handles this, but in standard architectures, the indexer is the destination.

Answer

Search Head

Answer

License Master

Answer

Deployment Server

Question 14

In a multi-site indexer cluster, which setting controls the number of copies of data kept per site?

Accepted Answer

site_replication_factor. The 'site_replication_factor' is configured in server.conf on the cluster master to define replication behavior across sites.

Answer

max_site_copies

Answer

site_data_count

Answer

cross_site_replication

Question 15

Which command helps you understand if your search is retrieving too much data from the disk by analyzing the 'index_time' and 'search_time'?

Accepted Answer

Search Inspector. The Search Inspector gives a breakdown of how much time was spent on disk I/O versus processing, aiding in performance tuning.

Answer

Monitoring Console Search Activity Dashboard

Answer

btool

Answer

splunkd log analysis

Question 16

When tuning search performance, what is the 'join' command's primary drawback in terms of resource usage?

Accepted Answer

It consumes significant memory on the search head. The 'join' command forces all results to be kept in memory on the search head, which is highly inefficient and resource-heavy.

Answer

It requires data to be fully ingested before searching

Answer

It causes high disk I/O on the indexer

Answer

It disables parallel processing

Question 17

What is the primary benefit of 'bucket rolling' in an indexer?

Accepted Answer

Allows the indexer to optimize disk I/O by isolating active writing to a single bucket. Bucket rolling moves data from the 'hot' state to 'warm', allowing the indexer to finalize the bucket and start a new hot bucket, effectively managing system resources.

Answer

Enables the indexer to bypass the parsing queue

Answer

Increases the size of the bucket for better compression

Answer

Reduces the requirement for indexes to be searchable

Question 18

What is the impact of placing a very high number of indexes on a single indexer?

Accepted Answer

Increased file handle usage and potential performance degradation. Too many indexes create too many open file handles and increase the overhead of bucket management, hurting disk I/O performance.

Answer

Reduced licensing costs

Answer

Improved search speed

Answer

Faster data ingestion

Question 19

Which tool is best for monitoring the health and performance of the entire Splunk environment?

Accepted Answer

Monitoring Console. The Monitoring Console (MC) is the built-in tool for health and performance monitoring.

Answer

Splunk CLI

Answer

Deployment Server

Answer

Splunk Web UI

Question 20

Which Splunk process is responsible for managing the indexer's disk I/O and bucket lifecycle?

Accepted Answer

splunkd. The 'splunkd' process handles all core management, including bucket lifecycle and disk I/O.

Answer

mongod

Answer

python

Answer

kvstore