You need to perform a clean upgrade of an indexer in a cluster. You place the indexer into maintenance mode. What happens to the replication and search factor during this time?
You are troubleshooting a clustered indexer environment where buckets are stuck in a 'streaming' state. Which log file on the indexer peer should you examine to determine why the replication is failing?
You are performing a maintenance task on a Search Head Cluster (SHC). You need to ensure the Captain is not currently running any scheduled reports before you decommission it. Where do you check this?
During a rolling upgrade of an Indexer Cluster, one indexer fails to rejoin the cluster. The Cluster Master indicates the node is 'Down'. Which command should you run on the Indexer Peer to verify if the indexer has successfully joined the cluster manager's configuration secret?
You want to troubleshoot why a specific search head is failing to offload scheduled searches. Which log on the Search Head should you review for delegation errors?
During an upgrade, you need to verify that all indexers are running the same version of the Splunk software. What is the most efficient way to check this across the entire cluster using the CLI?
You have a deployment server managing multiple forwarder classes. You need to update a configuration file for only one specific server class. Which directory on the Deployment Server should you update?
When troubleshooting a failed App deployment, which log on the Deployment Client should you check to confirm that the app was downloaded and extracted?
A user cannot log in to the Splunk instance. You suspect authentication is failing. Which log should you check to see the authentication attempt details?
A cluster master is reporting that an indexer is out of disk space. After you add more disk space, what is the best way to force the indexer to re-check its storage and clear the error?
You have a search head that is part of a cluster. You want to see the current list of peers it is communicating with. Which command is most appropriate?
You are managing a large indexer cluster and notice that search performance is inconsistent. Which TWO of the following items should you investigate to troubleshoot search distribution issues?
You are tasked with reviewing the health of a Search Head Cluster. Which TWO of the following dashboard locations in the Monitoring Console would be most helpful for this?
When troubleshooting a failed rolling upgrade of an Indexer Cluster, which TWO of the following log files on the Cluster Master will provide the most relevant information regarding the peer's failure to return to the cluster?
You have a cluster where buckets are not replicating as expected. Which THREE of the following factors should you verify to troubleshoot the replication failure?
You are setting up the Monitoring Console to monitor a distributed environment. Which THREE of the following steps are required to ensure the Monitoring Console is correctly configured?
You are troubleshooting a scenario where the Indexer Cluster is not meeting its 'Search Factor' requirement. Which TWO of the following actions can help you resolve this?
You notice that the Monitoring Console reports that the 'Search Head Captain' has changed. Which TWO of the following logs would contain the most information about this event?
A Splunk Enterprise deployment uses an indexer cluster with a search head cluster. Users report that dashboard panels take much longer than usual, and the Monitoring Console shows that the search head cluster captain has changed three times in the last hour. You need to review the most relevant artifacts to determine why the captain is flapping. (Choose two.)
A Splunk Enterprise deployment has a search head cluster and an indexer cluster. Users report that a saved search scheduled to run every 15 minutes has not produced alerts for the last hour. You need to determine which search head in the search head cluster is currently running the scheduled search. Which command should you run on a search head cluster member?
You notice that the Monitoring Console (MC) reports a 'Disk usage' warning for an indexer. Which dashboard should you navigate to in order to identify which specific index is consuming the most disk space?
You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?
An Indexer Cluster is experiencing 'Search Factor' violations. Which component is responsible for orchestrating the fix-up process to restore the search factor?
A user reports that they cannot see data from an indexer peer in the Monitoring Console. Which service should you check first to ensure the MC is able to communicate with the remote instance?
You are investigating a scenario where search performance has degraded. You observe that many searches are hitting the 'warm' buckets but not the 'cold' buckets. Where should you look to verify bucket rotation policies?
You are troubleshooting a KV store issue in an Indexer Cluster. Which command allows you to verify the status of the KV store and its replication on a node?
You are monitoring indexer performance. Which metric in the Monitoring Console's 'Indexing Performance' dashboard best indicates a bottleneck in the ingestion pipeline?
When upgrading a cluster, you have successfully upgraded the Master. Now you are moving to the Indexer Peers. What is the recommended order for upgrading the peers?
You notice that your indexers are using different versions of a lookup file. Where should you look to find the authoritative version of the lookup file if it is being managed by the Cluster Master?
A user claims that a search is not returning data from a specific time range. You suspect the data has been rolled to cold storage and the cold storage is not being searched. Which configuration file controls which cold paths are included in the search?
You are using the Monitoring Console to view the 'Search Head Clustering: Status' dashboard. You see that one of the nodes is showing as 'Missing'. What does this status imply?
You are troubleshooting a slow indexer cluster. You identify that the 'replication_port' is experiencing high latency. Where is the replication port defined?
You are troubleshooting a configuration bundle replication issue in an Indexer Cluster. The peers are not receiving the latest configuration from the Master. What is the first thing you should check on the Cluster Master?
You have determined that a specific app deployed via the Deployment Server is causing indexer errors. Which THREE of the following actions can you take to rectify this?
A Splunk architect notices that an indexer cluster's search head is returning incomplete results for a search spanning the last 7 days. The Monitoring Console shows that several buckets are missing their searchable copies, and the cluster master reports a search factor (SF) of 2 but replication factor (RF) of 3. Which of the following best explains why the search results are incomplete and what should be done to remediate the issue?
An architect is troubleshooting a Splunk deployment where search head cluster members are unable to replicate the search head captain's knowledge bundle. The captain's log shows repeated errors about failing to push the bundle to a member. Which of the following is the most likely cause and the appropriate resolution?
An indexer cluster has a replication factor of 3 and a search factor of 2. The Monitoring Console shows several buckets in the cluster with a search factor of 1. You need to confirm whether the cluster manager is actively fixing these buckets. Which command should you run on the cluster manager to view the status of bucket fixup tasks?
A deployment server manages a large number of universal forwarders. Several forwarders in a server class named `linux_web` have stopped receiving configuration updates after you modified a `props.conf` file in the deployment app. You need to determine why the deployment server is not pushing the updated configuration to those forwarders. Which log file on the deployment server should you examine first?
You are using the Monitoring Console to monitor a distributed Splunk Enterprise environment. A dashboard that previously showed data for all indexers now displays 'No results found' for several panels. You have confirmed that the indexers are up and forwarding data. Which action should you take first to restore the Monitoring Console's visibility into those indexers?