SPLK-2002 Troubleshooting And Operations — 10 Questions

Question 1

You need to perform a clean upgrade of an indexer in a cluster. You place the indexer into maintenance mode. What happens to the replication and search factor during this time?

Accepted Answer

Bucket fix-up activities are suspended for this peer. Maintenance mode prevents the Master from triggering bucket fix-ups (re-replication) when that specific node goes offline, preventing unnecessary data movement.

Answer

The Master initiates bucket re-replication immediately

Answer

The search factor is lowered to zero

Answer

Search queries are routed to other peers

Question 2

You are troubleshooting a clustered indexer environment where buckets are stuck in a 'streaming' state. Which log file on the indexer peer should you examine to determine why the replication is failing?

Accepted Answer

replication_data.log. The replication_data.log tracks the replication stream between indexers, making it the primary resource for debugging replication issues.

Answer

metrics.log

Answer

cluster_master.log

Answer

splunkd.log

Question 3

You are performing a maintenance task on a Search Head Cluster (SHC). You need to ensure the Captain is not currently running any scheduled reports before you decommission it. Where do you check this?

Accepted Answer

Search Head Clustering: Status dashboard. The 'SHC Captain's Status' dashboard or the 'splunk show shcluster-status' command reveals the current job activity.

Answer

Monitoring Console: Search: Activity dashboard

Answer

The 'distsearch.conf' file

Answer

The 'savedsearches.conf' file

Question 4

You notice that the Monitoring Console (MC) reports a 'Disk usage' warning for an indexer. Which dashboard should you navigate to in order to identify which specific index is consuming the most disk space?

Accepted Answer

Indexes and Volumes: Instance. The 'Index Volume' dashboard in the MC provides a breakdown of usage by index.

Answer

Indexing Performance: Instance

Answer

Resource Usage: Indexer Instance

Answer

Cluster Status

Question 5

You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?

Accepted Answer

Indexer Cluster: Status. The 'Indexer Cluster: Status' dashboard is the primary location for monitoring cluster health.

Answer

Indexing Performance: Cluster

Answer

Resource Usage: Indexer Cluster

Answer

Distributed Search: Status

Question 6

An Indexer Cluster is experiencing 'Search Factor' violations. Which component is responsible for orchestrating the fix-up process to restore the search factor?

Accepted Answer

The Cluster Master. The Cluster Master detects the violation and triggers the bucket fix-up process.

Answer

The Indexer Peer containing the missing copies

Answer

The Search Head

Answer

The Deployment Server

Question 7

You have added a new indexer to a cluster. The indexer is up, but the Cluster Master does not show it as 'Ready'. What is the most likely cause?

Accepted Answer

The security key on the indexer does not match the Cluster Master. The 'Ready' state requires the indexer to be connected and acknowledged by the master, often failing if the security keys do not match.

Answer

The indexer is missing the license file

Answer

The cluster master is in maintenance mode

Answer

The indexer has not indexed any data yet

Question 8

During a rolling upgrade of an Indexer Cluster, one indexer fails to rejoin the cluster. The Cluster Master indicates the node is 'Down'. Which command should you run on the Indexer Peer to verify if the indexer has successfully joined the cluster manager's configuration secret?

Accepted Answer

splunk show cluster-config. The 'splunk show cluster-config' command displays the current cluster master settings on the peer.

Answer

splunk validate cluster-config

Answer

splunk list cluster-members

Answer

splunk status

Question 9

A user reports that they cannot see data from an indexer peer in the Monitoring Console. Which service should you check first to ensure the MC is able to communicate with the remote instance?

Accepted Answer

splunkd. The splunkd service is the core engine required for all Splunk communications.

Answer

splunkweb

Answer

mongod

Answer

Deployment Client

Question 10

You want to troubleshoot why a specific search head is failing to offload scheduled searches. Which log on the Search Head should you review for delegation errors?

Accepted Answer

scheduler.log. The scheduler.log contains all information regarding the initiation and execution of scheduled reports.

Answer

searchservice.log

Answer

dispatch.log

Answer

audit.log