SPLK-2002 Quick Quiz — 10 Questions

Question 1

What is the primary function of the 'Cluster Master' in an Indexer Cluster?

Accepted Answer

To manage the indexer cluster's configuration and bucket state. The Cluster Master (now called Cluster Manager in newer versions) in an Indexer Cluster is responsible for managing the cluster's configuration and bucket state. It coordinates replication, tells indexers which buckets to replicate, manages search affinity, and handles peer registration. It does not handle data ingestion or serve the UI.

Answer

To handle incoming data from universal forwarders

Answer

To serve the Splunk user interface

Answer

To search across all indexers

Question 2

Which TWO of the following are valid ways to monitor the status of an Indexer Cluster?

Accepted Answer

Using the CLI command 'splunk show cluster-status'.. Option B is correct because the Splunk CLI command 'splunk show cluster-status' (run on a cluster manager or member) reports the health and status of the indexer cluster, including peer and search head connectivity and replication status. Option C is correct because the Monitoring Console provides a dedicated Indexer Clustering dashboard that surfaces cluster health, peer status, replication and search factor compliance, and bucket-fixup activity. Option A is incorrect because license usage logs track license consumption, not cluster health or peer status. Option D is incorrect because forwarder logs show data forwarding activity and connectivity from the forwarder's perspective, not the status of the indexer cluster itself. Option E is incorrect because running a search on indexers tests search functionality but does not provide a valid, supported method for monitoring overall indexer cluster status.

Answer

Checking the license usage logs.

Answer

Reviewing the forwarder logs.

Answer

Running a search on the indexers directly.

Question 3

You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?

Accepted Answer

Use the local/ directory for configuration files that should not be replicated. In a Search Head Cluster, configurations are replicated from the deployer or captain via bundles, but files in the local/ directory of an app or system are not replicated and are preserved on each member. To keep local user configurations from being overwritten by cluster-wide bundles, you place them in the local/ directory, which takes precedence and is not overwritten by replicated configurations.

Answer

Move files to the var/run directory

Answer

Set the configuration to immutable in server.conf

Answer

Use the shcluster/ directory

Question 4

When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?

Accepted Answer

To define the number of copies of search artifacts. In an SHC, the replication_factor defines how many copies of the search-related configurations are replicated across members.

Answer

To limit the number of users

Answer

To specify the number of search nodes in the cluster

Answer

To balance the search load across nodes

Question 5

Which type of bucket is used for the most recent data and is generally searchable?

Accepted Answer

Hot. Hot buckets contain the most recent, actively written data and are the only bucket type that is both writable and searchable in real time. When data ages or reaches a size threshold, hot buckets roll to warm, which are searchable but no longer written to. Therefore hot is the correct answer for 'most recent data and generally searchable.'

Answer

Warm

Answer

Cold

Answer

Frozen

Answer

Thawed

Question 6

An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?

Accepted Answer

An S3-compatible object store. SmartStore requires an S3-compatible object store as the remote storage tier because it uses the S3 API to upload and download bucket data (rawdata and tsidx) to remote storage while keeping only cache and metadata locally. Splunk supports Amazon S3, S3-compatible stores (e.g., MinIO, Dell ECS), Azure Blob, and GCS via the appropriate remote storage provider. Local RAID, NAS, or SAN do not expose the S3 API that SmartStore depends on.

Answer

A local RAID 10 array

Answer

A network-attached storage (NAS) with NFS v4

Answer

A SAN with Fibre Channel connectivity

Question 7

If a search head is overloaded with concurrent searches, what is the best strategy to offload the processing?

Accepted Answer

Implement a Search Head Cluster. A Search Head Cluster distributes search workload across multiple search head members, allowing concurrent searches to be load-balanced and providing horizontal scaling for search processing. This directly addresses an overloaded single search head by adding capacity and redundancy. Increasing indexers or indexer memory addresses indexing/search execution at the indexer layer, not the search head's concurrency bottleneck.

Answer

Increase the number of indexers

Answer

Reduce the number of users

Answer

Increase indexer memory

Question 8

An architect is designing an index lifecycle for compliance. The requirement is to keep data for exactly 7 years. Which setting must be configured to prevent premature deletion?

Accepted Answer

frozenTimePeriodInSecs. frozenTimePeriodInSecs is the index-level setting in indexes.conf that defines the age (in seconds) at which buckets roll from cold to frozen, triggering deletion (or archival if a coldToFrozenScript/archiver is configured). Setting it to 7 years (220,752,000 seconds) ensures data is retained for exactly that period before being frozen. This is the only setting in the list that controls retention by time rather than by size or count.

Answer

maxTotalDataSizeMB

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Question 9

You are troubleshooting a KV store issue in an Indexer Cluster. Which command allows you to verify the status of the KV store and its replication on a node?

Accepted Answer

splunk show kvstore-status. The command 'splunk show kvstore-status' is the supported CLI command to display the KV Store status on a Splunk instance, including replication status, port, and storage engine details. It works on indexers, search heads, and cluster members, making it the correct tool for verifying KV Store health and replication in an Indexer Cluster.

Answer

mongostat

Answer

check_kvstore.py

Answer

splunk status kvstore

Question 10

Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?

Accepted Answer

Service load is too high causing timeouts.. Option A is correct because a Search Head Cluster member under excessive service load can fail to respond to the captain's periodic heartbeats within the configured timeout, causing the captain to mark it as down and lose contact. Option D is correct because network instability (packet loss, latency, or intermittent connectivity) disrupts the heartbeat and replication traffic between members and the captain, breaking the cluster communication. Option E is correct because the captain and members communicate over the replication port (default 9887), so if a firewall blocks that port, the member cannot exchange heartbeats or replicate artifacts and loses contact with the captain. Option B is not a cause because the license master is unrelated to SHC captain heartbeat communication; a member can remain in contact with the captain even if licensing is unavailable. Option C is not a cause because indexer cluster load affects search and indexing performance, not the SHC internal captain-member heartbeat channel.

Answer

License master is offline.

Answer

The indexer cluster is busy.