SPLK-2002 Performance Tuning — Timed 10 Questions

Question 1

A Splunk administrator needs to identify why a specific search is experiencing high 'Disk Read' wait times. Which tool or log source should be utilized to correlate search IDs with specific disk latency metrics?

10 minute time limit — choose an answer to begin.

Accepted Answer

Audit logs correlated with indexer metrics via the Monitoring Console. The Monitoring Console aggregates indexer metrics, including disk latency, and can correlate those with search activity. Audit logs record search IDs and user actions, so combining audit logs with indexer metrics via the Monitoring Console allows an administrator to link a specific search ID to disk read wait times. The other tools either lack the necessary correlation or do not provide disk latency metrics.

Answer

Search Inspector

Answer

Splunk Web UI Performance Monitor

Answer

splunkd.log

Question 2

You are tuning a Splunk heavy forwarder. The 'parsingQueue' is consistently full. Which configuration change in props.conf or inputs.conf is recommended?

Accepted Answer

Increase the 'maxQueueSize' for the parsing queue in limits.conf. The parsing queue is typically blocked by complex regex transformations or heavy parsing loads. Adjusting pipeline settings or splitting the workload across more CPUs is necessary.

Answer

Reduce the number of indexers in the output group

Answer

Disable 'sourcetype' auto-discovery

Question 3

Which setting in indexes.conf should be tuned to balance memory usage and indexing speed for a high-volume indexer?

Accepted Answer

maxDataSize. maxDataSize controls the target size of hot buckets before Splunk rolls them to warm; tuning it directly balances how much memory the indexer dedicates to active buckets versus how frequently it performs bucket rolling and disk I/O. Larger values keep more data in memory (faster search/indexing) but consume more RAM, while smaller values reduce memory pressure at the cost of more frequent rolling. This is the primary knob in indexes.conf for that trade-off.

Answer

hot_bucket_count

Answer

io_priority

Answer

block_size

Question 4

An administrator notices that searches are slow due to high CPU utilization on indexers. Which configuration change in limits.conf directly controls the maximum number of concurrent searches allowed on an indexer?

Accepted Answer

max_searches_per_cpu. max_searches_per_cpu in limits.conf sets the multiplier applied to the number of CPU cores to determine the maximum concurrent searches an indexer will run. Splunk computes the cap as max_searches_per_cpu × number of cores, so lowering this value directly throttles concurrent search load and reduces CPU contention. This is the documented knob for controlling search concurrency per indexer.

Answer

concurrent_search_limit

Answer

base_max_searches

Answer

max_searches

Question 5

When using Data Model acceleration, which setting should be monitored to ensure the background summary search does not starve other searches of resources?

Accepted Answer

accelerated_search_max_threads. The 'tstats_max_search_time' or similar limits in limits.conf manage how long these accelerated searches run, but the 'accelerated_search_max_threads' setting controls the concurrency.

Answer

summary_index_concurrency

Answer

max_summary_size

Answer

data_model_memory_limit

Question 6

When performance tuning the 'Splunk Web' interface for users, which configuration helps manage the 'Search Results' cache?

Accepted Answer

cache_results in limits.conf. In Splunk, the search results cache is controlled by the 'cache_results' setting in limits.conf, which determines whether search results are cached and how the cache behaves. Tuning this setting helps manage how often identical searches reuse cached results versus re-running against the indexers, directly impacting Splunk Web responsiveness and indexer load. This is the documented configuration for managing the search results cache.

Answer

results_ttl in server.conf

Answer

max_results_cache in authorize.conf

Answer

web_cache_size in web.conf

Question 7

Which Splunk component is responsible for receiving data from forwarders and distributing it to the correct indexers?

Accepted Answer

Indexer. In Splunk, the indexer is the component that receives data from forwarders (universal or heavy) and indexes it. Indexers also distribute data to other indexers in a cluster based on replication and search factors. Thus, the indexer is responsible for both receiving and distributing data to the correct indexers in a clustered environment.

Answer

Search Head

Answer

License Master

Answer

Deployment Server

Question 8

You are configuring a heavy forwarder to filter data before sending it to indexers. Which stanza in props.conf is used to define the filtering criteria?

Accepted Answer

[sourcetype::*]. Filtering is performed using the 'TRANSFORMS' attribute in props.conf, which points to a stanza in transforms.conf.

Answer

[FILTER]

Answer

[OUTPUT]

Answer

[FORWARDER]

Question 9

An indexer is running out of disk space. Which setting in indexes.conf prevents the indexer from crashing by stopping ingestion?

Accepted Answer

maxTotalDataSizeMB. maxTotalDataSizeMB sets a hard size ceiling for an index. When the index reaches this limit, Splunk rolls the oldest buckets to frozen and deletes them (or archives them), freeing disk space so ingestion can continue without the indexer running out of disk and crashing. This is the correct setting to cap index growth and prevent disk exhaustion.

Answer

frozenTimePeriodInSecs

Answer

minFreeSpaceMB

Answer

maxHotBuckets

Question 10

Which setting in limits.conf limits the amount of memory a single search can consume on the search head?

Accepted Answer

max_mem_usage_mb. In Splunk's limits.conf, the [search] stanza contains the setting max_mem_usage_mb, which caps the memory (in megabytes) that a single search process can consume on the search head. When a search exceeds this limit, Splunk terminates it to prevent resource exhaustion. This is the correct setting for controlling per-search memory usage on the search head.

Answer

process_memory_limit

Answer

max_ram_per_search

Answer

search_memory_limit