SPLK-2002 Quick Quiz — 10 Questions

Question 1

Which TWO of these factors determine when a bucket rolls from hot to warm?

Accepted Answer

maxDataSize. Bucket rolling is triggered by either the size (maxDataSize) or time (maxHotSpanSecs).

Answer

maxWarmDBCount

Answer

maxTotalDataSizeMB

Answer

frozenTimePeriodInSecs

Question 2

In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?

Accepted Answer

Maintaining the bucket registry and managing replication status.. The CM assigns bucket IDs and manages bucket replication/searchability across peers, but it does not store the raw indexed data itself.

Answer

Directing search requests to specific indexers.

Answer

Indexing incoming forwarder data.

Answer

Storing raw data and serving search requests.

Answer

Aggregating search results from indexers.

Question 3

Which setting in indexes.conf should be tuned to balance memory usage and indexing speed for a high-volume indexer?

Accepted Answer

maxDataSize. maxDataSize determines the size of the TSIDX files before rolling, which impacts how often the indexer performs merge operations.

Answer

hot_bucket_count

Answer

io_priority

Answer

block_size

Question 4

You are configuring Data Model Acceleration on a heavy forwarder. Why is this not a recommended architectural practice?

Accepted Answer

Acceleration requires the indexer components for summary storage. Heavy forwarders lack the indexing and search head components required to manage and serve accelerated summaries efficiently.

Answer

Heavy forwarders do not support accelerated datamodels

Answer

The license will be consumed incorrectly

Answer

CPU resources on the forwarder are too high

Question 5

When using a Search Head Cluster, what is the purpose of the 'captain'?

Accepted Answer

To coordinate search scheduling and replicate configuration bundles.. The captain manages the search head cluster's configuration, coordinates job scheduling, and maintains the cluster state.

Answer

To act as the Cluster Master for indexers.

Answer

To store all bucket data for the indexers.

Answer

To receive data from forwarders.

Answer

To distribute search results to the end user.

Question 6

Which TWO of the following are valid bucket states in the Splunk index lifecycle?

Accepted Answer

Hot. Hot, Warm, Cold, and Frozen are the standard lifecycle states.

Answer

Active

Answer

Pending

Answer

System

Question 7

An indexer cluster is suffering from 'bucket repair' loops. What is the most likely cause related to the bucket lifecycle?

Accepted Answer

Bucket corruption preventing indexer recovery. Bucket corruption is often due to improper shutdown or hardware failure, but repair loops specifically indicate an issue with the bucket's integrity on disk.

Answer

Insufficient replication factor

Answer

Excessive search concurrency

Answer

Misconfigured cold path

Question 8

You have added a new indexer to a cluster. The indexer is up, but the Cluster Master does not show it as 'Ready'. What is the most likely cause?

Accepted Answer

The security key on the indexer does not match the Cluster Master. The 'Ready' state requires the indexer to be connected and acknowledged by the master, often failing if the security keys do not match.

Answer

The indexer is missing the license file

Answer

The cluster master is in maintenance mode

Answer

The indexer has not indexed any data yet

Question 9

A customer is experiencing 'Search peer [peer-name] is not responding' errors during indexer maintenance. Which configuration parameter in server.conf should be tuned to prevent search failures during rolling restarts?

Accepted Answer

restart_timeout. The 'restart_timeout' parameter in the [clustering] stanza controls how long a search head waits for a peer to return before marking it as down during a rolling restart.

Answer

peer_down_timeout

Answer

max_search_time

Answer

heartbeat_timeout

Answer

search_retry_timeout

Question 10

Which THREE settings should you tune to optimize Data Model Acceleration?

Accepted Answer

acceleration.max_time. Acceleration is managed through the datamodels.conf file, specifically regarding backfill, retention, and cron schedules.

Answer

index_retention

Answer

max_summary_size