Sample questions
Splunk Enterprise Certified Architect (SPLK-2002) (SPLK-2002) practice questions
Which TWO of these factors determine when a bucket rolls from hot to warm?
In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?
Which setting in indexes.conf should be tuned to balance memory usage and indexing speed for a high-volume indexer?
You are configuring Data Model Acceleration on a heavy forwarder. Why is this not a recommended architectural practice?
When using a Search Head Cluster, what is the purpose of the 'captain'?
High Availability And Distributed SearchmediumSee the answer and why each option is right or wrong →Which TWO of the following are valid bucket states in the Splunk index lifecycle?
An indexer cluster is suffering from 'bucket repair' loops. What is the most likely cause related to the bucket lifecycle?
You have added a new indexer to a cluster. The indexer is up, but the Cluster Master does not show it as 'Ready'. What is the most likely cause?
A customer is experiencing 'Search peer [peer-name] is not responding' errors during indexer maintenance. Which configuration parameter in server.conf should be tuned to prevent se…
Which THREE settings should you tune to optimize Data Model Acceleration?
Which metric is the best predictor of the storage needed for an indexer in a cluster?
A Splunk architect is calculating the storage requirement for an index that receives 500GB of raw data per day, with a 30-day retention period and a standard 50% compression ratio.…
Which configuration file and stanza are used to define the bucket lifecycle policy for a custom index named 'customer_data'?
A Splunk architect is performing capacity planning. If an indexer receives 1TB of logs daily, and the Splunk compression factor is 1:10 (resulting in 100GB of storage per day), how…
An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?
A large-scale Splunk deployment is experiencing 'bucket rolling' latency. Upon investigation, you determine that the indexer is waiting for the indexer cluster manager to acknowled…
Which THREE factors influence the disk I/O performance of an indexer cluster?
Which component in a distributed search environment is responsible for the 'Search Affinity' feature?
When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?
If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?
When planning a Splunk upgrade, which THREE of the following actions are considered best practices for maintaining system health?
You are troubleshooting a clustered indexer environment where buckets are stuck in a 'streaming' state. Which log file on the indexer peer should you examine to determine why the r…
You need to perform a clean upgrade of an indexer in a cluster. You place the indexer into maintenance mode. What happens to the replication and search factor during this time?
A Splunk administrator needs to identify why a specific search is experiencing high 'Disk Read' wait times. Which tool or log source should be utilized to correlate search IDs with…