Splunk Enterprise Certified Architect (SPLK-2002) (SPLK-2002) SPLK-2002 Questions 76–123 | Page 2/2

MCQeasy

Which command is used to check the health of an Indexer Cluster from the Cluster Master CLI?

A.splunk cluster-check

B.splunk show cluster-status

C.splunk inspect-cluster

D.splunk search-peers

E.splunk list indexers

AnswerB

Running splunk show cluster-status on the Cluster Master returns cluster health, including replication and search factor status and peer availability. This directly satisfies the stem's constraint of checking Indexer Cluster health from the Cluster Master CLI rather than the monitoring console.

Why this answer

The command 'splunk show cluster-status' is used on the Cluster Master (now called Cluster Manager) to display the health and status of the indexer cluster, including information about peers, replication, and search factors. It provides a summary of the cluster's overall state.

Exam trap

The trap is confusing similar-sounding commands — candidates may pick 'splunk cluster-check' or 'splunk inspect-cluster' because they sound plausible, but the correct command is 'splunk show cluster-status'.

How to eliminate wrong answers

Option A is wrong because 'splunk cluster-check' is not a valid Splunk CLI command. Option C is wrong because 'splunk inspect-cluster' is not a valid command. Option D is wrong because 'splunk search-peers' is not a valid command for checking cluster health.

Option E is wrong because 'splunk list indexers' is not a valid command; while there are commands to list peers, the standard health check command is show cluster-status.

Full explanation →

MCQmedium

An architect is configuring a Splunk indexer cluster with SmartStore. The remote storage is an S3 bucket. To ensure data integrity and availability, the architect must configure the cluster to use a remote storage that supports which feature?

A.Strong read-after-write consistency

B.Cross-region replication

C.Server-side encryption

D.Object versioning

AnswerA

SmartStore requires strong read-after-write consistency to ensure that when an indexer uploads a bucket to remote storage, any subsequent read from another indexer (or the same one) returns the latest version. Without this, searches might miss recently indexed data or retrieve stale buckets, leading to inconsistencies and potential data loss.

Why this answer

SmartStore relies on strong read-after-write consistency to ensure that uploaded buckets are immediately visible to all indexers. This guarantees that searches access the most recent data and prevents inconsistencies, making it a fundamental requirement for remote storage backends.

Exam trap

The trap here is confusing optional security or redundancy features like encryption or versioning with the core consistency requirement that SmartStore depends on.

Full explanation →

MCQeasy

Which dashboard in the Monitoring Console provides the best overview of resource consumption per search head?

A.Search Head Activity

B.Data Ingestion Performance

C.Resource Usage: Forwarders

D.Indexer Activity

AnswerA

Search Head Activity reports per-search-head resource usage, including CPU, memory and disk consumption, letting you compare load across the search head tier. It directly satisfies the stem's requirement for a per-search-head view of resource consumption rather than cluster-wide or indexer-focused metrics.

Why this answer

The Search Head Activity dashboard in the Monitoring Console provides the best overview of resource consumption per search head, showing metrics such as CPU usage, memory, disk I/O, and search load broken down by search head. It is designed specifically to help admins identify which search heads are under heavy load and to balance search distribution. Other dashboards focus on different tiers (indexers, forwarders) or different concerns (ingestion performance).

Exam trap

SPLK-2002 often tests whether candidates know which Monitoring Console dashboard maps to which tier — Search Head Activity for search heads, Indexer Activity for indexers, and Resource Usage: Forwarders for forwarders — so candidates who pick a dashboard by name similarity rather than tier focus get it wrong.

How to eliminate wrong answers

Option B is wrong because Data Ingestion Performance focuses on indexing throughput and pipeline performance, not search head resource consumption. Option C is wrong because Resource Usage: Forwarders reports on universal forwarder resource usage, not search heads. Option D is wrong because Indexer Activity covers indexer-tier metrics such as indexing rate, bucket activity, and disk usage, not search head resources.

Full explanation →

MCQeasy

Which component in Splunk is required to be the central point for managing licenses in a clustered environment?

A.The License Master

B.The Deployment Server

C.The Search Head

D.The Cluster Master

AnswerA

The license master is the single Splunk instance that holds and distributes licence entitlements to all other members of a clustered deployment. It centralises licence management so peers and search heads do not each require separate licence files, satisfying the central-point requirement.

Why this answer

In a Splunk clustered environment, the License Master is the central component that manages and distributes licenses to all licensees (indexers, search heads, etc.). It enforces license usage limits and provides a single point of administration for licensing.

Exam trap

SPLK-2002 often tests the confusion between the License Master and the Cluster Master, since both are central management components, but only the License Master handles licensing.

How to eliminate wrong answers

Option B (Deployment Server) is wrong because it distributes apps and configurations to forwarders, not licenses. Option C (Search Head) is wrong because search heads consume licenses but do not manage them. Option D (Cluster Master) is wrong because it manages indexer clustering (bucket replication, search affinity) but not licensing.

Full explanation →

MCQmedium

When adding a new indexer to a multisite cluster, which attribute must be correctly set in the configuration before joining the cluster?

A.The indexer's role

B.The license server path

C.The search head affinity index

D.The site assignment

AnswerD

Critical for multisite replication logic.

Why this answer

In a multisite indexer cluster, each indexer must be assigned to a site (site0, site1, etc.) via the 'site' attribute in server.conf under the [general] stanza or in the clustering stanza. This site assignment determines replication and search affinity behavior, so it must be correctly set before the indexer joins the cluster.

Exam trap

SPLK-2002 often tests the distinction between general clustering attributes (like master_uri, pass4SymmKey) and multisite-specific attributes (like site), causing candidates to choose a generic role or license setting instead of the site assignment.

How to eliminate wrong answers

Option A is wrong because the indexer's role (peer, master, search head) is defined by the clustering configuration and is not the multisite-specific attribute required for joining. Option B is wrong because the license server path is unrelated to site assignment and is configured in server.conf but does not affect cluster joining. Option C is wrong because 'search head affinity index' is not a valid configuration attribute for indexers; search affinity is a search head setting, not an indexer joining requirement.

Full explanation →

MCQhard

A deployment server manages a large number of universal forwarders. Several forwarders in a server class named `linux_web` have stopped receiving configuration updates after you modified a `props.conf` file in the deployment app. You need to determine why the deployment server is not pushing the updated configuration to those forwarders. Which log file on the deployment server should you examine first?

A.`$SPLUNK_HOME/var/log/splunk/license_usage.log`

B.`$SPLUNK_HOME/var/log/splunk/splunkd_access.log`

C.`$SPLUNK_HOME/var/log/splunk/splunkd.log`

D.`$SPLUNK_HOME/var/log/splunk/metrics.log`

AnswerC

The deployment server logs deployment-related activity in splunkd.log, including client connections, phone-home requests, and errors when serving configuration bundles. Messages about failed bundle downloads or server class mapping issues appear here, making it the first place to check why forwarders in the `linux_web` server class are not receiving updates.

Why this answer

The deployment server records client phone-home activity, server class matching, and bundle delivery errors in splunkd.log. When forwarders stop receiving updates, this log reveals whether they are connecting, whether they are being mapped to the correct server class, and whether bundle downloads are failing due to permissions or content issues.

Exam trap

The trap here is looking at access or metrics logs for deployment activity, when deployment client connections and bundle errors are recorded in splunkd.log.

Full explanation →

MCQmedium

You manage a Splunk indexer cluster with three peer nodes, a cluster manager, and a search head. The search head is configured with the cluster manager's URI in its server.conf under [clustering]. A new compliance requirement mandates that all searchable data copies must remain on the original peer that indexed the data, and replication to other peers is strictly prohibited. What should you do to meet this requirement while keeping the cluster functional?

A.Configure the search head to use only the originating peer for searches by setting search_factor to 0 and disabling replication.

B.Disable indexer clustering and revert the peers to standalone indexers, then configure the search head to query each indexer directly.

C.Set replication_factor to 1 in the cluster manager's server.conf under [clustering] and push the configuration to all peers.

D.Set the cluster manager to maintenance mode and manually assign buckets to peers using the splunk CLI bucket command.

AnswerB

Indexer clustering inherently replicates buckets across peers to ensure high availability and data recovery. To guarantee that data never leaves the originating peer, you must not use clustering. Reverting to standalone indexers and having the search head query them directly (e.g., via distributed search) ensures each indexer holds only its own data, satisfying the compliance requirement.

Why this answer

Indexer clustering is designed to replicate buckets across peers for fault tolerance and search efficiency. It does not support a mode where buckets are permanently pinned to their originating peer. The only way to meet a strict data locality requirement is to avoid clustering altogether and use standalone indexers with distributed search, ensuring that each indexer only stores and serves its own data.

Exam trap

The trap here is assuming that replication_factor or search_factor can enforce data locality, when they actually control copy counts and searchable copies, not the physical placement of buckets.

Full explanation →

MCQhard

You notice that your indexer cluster has 'Streaming' buckets that are not yet searchable. What is the most likely cause?

A.The indexer is in maintenance mode.

B.The indexer disk is full.

C.The license is expired.

D.The search factor is not met for these buckets.

E.The Cluster Master is down.

AnswerD

Streaming buckets hold replicated raw data that becomes searchable only once the search factor is satisfied, meaning enough searchable copies exist across peer nodes. Until that replication completes, the bucket remains non-searchable, so an unmet search factor is the cause.

Why this answer

In an indexer cluster, a bucket transitions from 'streaming' to 'searchable' only after the search factor (SF) is satisfied — meaning the required number of searchable copies exist across peers. If SF is not met (e.g., a peer holding a searchable copy is down), the bucket remains in the streaming state and cannot be searched. This is the canonical cause of 'streaming buckets not yet searchable' in Splunk clustering.

Exam trap

SPLK-2002 often tests the distinction between replication factor and search factor — candidates pick 'disk full' or 'CM down' because those sound like cluster-wide failures, but the specific symptom 'streaming not searchable' maps only to unmet SF.

How to eliminate wrong answers

Option A is wrong because maintenance mode on an indexer primarily affects its ability to receive new data and participate in fixups, but it doesn't directly define the streaming-to-searchable transition — SF satisfaction does. Option B is wrong because a full disk triggers bucket freezing/rollover and indexing pauses, not a persistent 'streaming but not searchable' state. Option C is wrong because an expired license blocks new indexing entirely rather than leaving buckets stuck in streaming.

Option E is wrong because if the Cluster Master is down, existing searchable buckets remain searchable; only new bucket replication and fixup operations stall.

Full explanation →

MCQeasy

Which of the following is a key advantage of using a Search Head Cluster over a single search head?

A.Faster indexing performance

B.Reduced license costs

C.Smaller storage footprint

D.High availability of search and user interface

AnswerD

A Search Head Cluster replicates search artefacts and configuration across multiple search head members, so if one member fails another continues serving searches and the user interface. This redundancy provides the high availability that a single search head cannot offer.

Why this answer

A Search Head Cluster (SHC) provides high availability and horizontal scaling for search and UI workloads: if one member fails, others continue serving searches, and users can be load-balanced across members. The captain coordinates configuration replication and artifact replication, but the core benefit is resilience and capacity for search, not indexing. Indexing is handled by indexers, not search heads, so SHC does not improve indexing performance.

Exam trap

SPLK-2002 often tests the misconception that a Search Head Cluster improves indexing or reduces licensing costs, when its actual value is search/UI high availability and horizontal scaling.

How to eliminate wrong answers

Option A is wrong because indexing performance is determined by indexer capacity, not search head architecture — search heads do not index data. Option B is wrong because license costs are based on daily indexed volume and are unaffected by whether you run one search head or a cluster. Option C is wrong because an SHC actually increases storage footprint (each member holds replicated configurations and search artifacts), not reduces it.

Full explanation →

MCQhard

When designing a large-scale multisite cluster, which factor most significantly impacts the search performance when running searches across all sites?

A.The number of buckets per indexer

B.The number of users

C.Network latency between sites

D.The number of search heads

AnswerC

Searching across all sites requires the search head to dispatch and gather results from indexers in every site, so inter-site network latency directly determines how quickly results return. Higher latency slows cross-site searches more than any other listed factor.

Why this answer

In a multisite indexer cluster, search heads must dispatch search requests to indexers in all sites and then merge results back. When a search spans all sites, the search head sends the search to peer nodes in every site, and results must traverse the WAN between sites. Network latency between sites directly adds to the round-trip time for each search phase (map and reduce), making it the dominant factor affecting cross-site search performance.

Exam trap

SPLK-2002 often tests the misconception that hardware resources like bucket count or user load are the primary factors in multisite search performance, when in fact network latency between sites is the critical bottleneck for cross-site searches.

How to eliminate wrong answers

Option A is wrong because the number of buckets per indexer affects local disk I/O and bucket replication, but it does not directly determine cross-site search latency; bucket count is more relevant to replication and search efficiency within a site. Option B is wrong because the number of users affects concurrent search load and resource contention, but it is not the primary factor for cross-site search performance; user count impacts overall cluster load, not the inherent latency of multisite searches. Option D is wrong because the number of search heads affects search concurrency and load balancing, but it does not directly influence the latency of searches that must traverse sites; more search heads can improve parallelism but do not reduce network latency between sites.

Full explanation →

MCQmedium

You have added a new indexer to a cluster. The indexer is up, but the Cluster Master does not show it as 'Ready'. What is the most likely cause?

A.The indexer is missing the license file

B.The cluster master is in maintenance mode

C.The security key on the indexer does not match the Cluster Master

D.The indexer has not indexed any data yet

AnswerC

Cluster Master readiness requires every peer to share the identical cluster security key; a mismatched key prevents the indexer from authenticating and joining the cluster, so it never transitions to Ready despite the service running.

Why this answer

For an indexer to join a cluster and reach 'Ready' status, it must present the same cluster security key (pass4SymmKey under the clustering stanza) as the cluster master. If the keys differ, the indexer can start and appear 'Up' but will be rejected during cluster handshake, so the master never marks it Ready.

Exam trap

SPLK-2002 often tests the distinction between 'Up' and 'Ready' — candidates assume any running indexer should be Ready, missing that cluster handshake (security key, master URI) is a separate gate from process health.

How to eliminate wrong answers

Option A is wrong because a missing license file would prevent Splunk from starting or would trigger license violations, but it does not specifically block cluster readiness — licensing is handled separately from cluster membership. Option B is wrong because maintenance mode on the master pauses certain cluster operations but does not prevent a new peer from being recognized; the peer would still show as pending/ready once maintenance ends. Option D is wrong because an indexer does not need to have indexed data to become Ready — readiness is about successful cluster handshake and bucket replication capability, not data volume.

Full explanation →

MCQhard

If a search head is overloaded with concurrent searches, what is the best strategy to offload the processing?

A.Increase the number of indexers

B.Reduce the number of users

C.Increase indexer memory

D.Implement a Search Head Cluster

AnswerD

A search head cluster distributes search workload across multiple search head members, so concurrent searches are spread rather than queued on one overloaded node. This satisfies the stem's requirement to offload processing while preserving a single search experience.

Why this answer

A Search Head Cluster distributes search workload across multiple search head members, allowing concurrent searches to be load-balanced and providing horizontal scaling for search processing. This directly addresses an overloaded single search head by adding capacity and redundancy. Increasing indexers or indexer memory addresses indexing/search execution at the indexer layer, not the search head's concurrency bottleneck.

Exam trap

SPLK-2002 often tests the misconception that adding indexers fixes search head overload; the search head is the concurrency bottleneck, and SHC is the correct scaling solution.

How to eliminate wrong answers

Option A is wrong because adding indexers increases indexing and search execution capacity but does not relieve the search head's role as the search coordinator and result aggregator. Option B is wrong because reducing users is a business constraint, not a technical scaling strategy. Option C is wrong because indexer memory helps search execution on indexers but does not solve search head concurrency limits.

Full explanation →

MCQmedium

You are investigating a scenario where search performance has degraded. You observe that many searches are hitting the 'warm' buckets but not the 'cold' buckets. Where should you look to verify bucket rotation policies?

A.outputs.conf

B.inputs.conf

C.server.conf

D.indexes.conf

AnswerD

Bucket rotation between warm and cold tiers is governed by the frozenTimePeriodInSecs and related retention settings defined per index in indexes.conf. Checking this file on the indexers verifies the policies controlling when warm buckets roll to cold.

Why this answer

Bucket rotation policies — including the thresholds that move buckets from hot to warm to cold to frozen, and the retention periods for each — are defined per index in indexes.conf. Parameters like maxHotBuckets, maxWarmDBCount, frozenTimePeriodInSecs, and homePath/coldPath control when and where buckets roll. To verify or change rotation behavior, you inspect indexes.conf on the indexers (or via the cluster manager for clustered environments).

Exam trap

SPLK-2002 often tests which .conf file owns which setting; candidates confuse server.conf (server-wide) with indexes.conf (per-index) and pick server.conf for bucket rotation, missing that rotation is an index-level property.

How to eliminate wrong answers

Option A is wrong because outputs.conf configures data forwarding destinations (indexers, heavy forwarders) and does not contain any bucket or index retention settings. Option B is wrong because inputs.conf defines data inputs (monitor, TCP/UDP, scripted inputs) and their sourcetypes/index routing; it has no bucket rotation parameters. Option C is wrong because server.conf controls general server behavior such as licensing, clustering, KV store, and search head settings, but not per-index bucket rotation policies.

Full explanation →

MCQeasy

You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?

A.Indexer Cluster: Status

B.Indexing Performance: Cluster

C.Resource Usage: Indexer Cluster

D.Distributed Search: Status

AnswerA

The Indexer Cluster: Status dashboard in the Monitoring Console aggregates peer node health, replication and search factor status, and bucket replication across all indexers. It provides the high-level cluster-wide overview the task requires, unlike per-node or per-index dashboards.

Why this answer

The Monitoring Console's 'Indexer Cluster: Status' dashboard is purpose-built to show a high-level health view of all indexer cluster nodes, including peer status, replication and search factor compliance, and bucket replication status. It aggregates cluster health so you can quickly see whether the cluster is fully replicated and whether any peers are down or lagging. The other dashboards focus on performance, resource usage, or distributed search rather than cluster replication health.

Exam trap

SPLK-2002 often tests the difference between cluster health (replication/peer status) and cluster performance (throughput/resource usage); candidates pick 'Indexing Performance: Cluster' because it also says 'Cluster' but it does not show replication status.

How to eliminate wrong answers

Option B is wrong because 'Indexing Performance: Cluster' focuses on indexing throughput, queue sizes, and pipeline metrics across the cluster, not on replication status or peer health. Option C is wrong because 'Resource Usage: Indexer Cluster' reports CPU, memory, disk, and I/O consumption across indexers, which is about capacity and resource pressure, not replication state. Option D is wrong because 'Distributed Search: Status' covers search head to indexer connectivity and search peer availability for distributed search, not indexer cluster replication or bucket health.

Full explanation →

MCQhard

Which configuration file and stanza are used to define the bucket lifecycle policy for a custom index named 'customer_data'?

A.datamodels.conf [customer_data]

B.server.conf [customer_data]

C.indexes.conf [customer_data]

D.inputs.conf [customer_data]

AnswerC

The `[customer_data]` stanza in `indexes.conf` defines per-index bucket lifecycle settings, including `frozenTimePeriodInSecs`, `maxHotBuckets` and `maxWarmDBCount`. Splunk reads these attributes at index creation and rollover, so placing the custom index's stanza here directly satisfies the requirement to configure its bucket lifecycle policy.

Why this answer

The bucket lifecycle policy for an index is defined in indexes.conf within the stanza for that index. The stanza name is the index name, so for 'customer_data', it's [customer_data]. This file contains settings like homePath, coldPath, frozenTimePeriodInSecs, and other retention-related parameters.

Exam trap

SPLK-2002 often tests the specific configuration file for index settings, causing candidates to confuse indexes.conf with other .conf files like inputs.conf or server.conf.

How to eliminate wrong answers

Option A is wrong because datamodels.conf is used to define data models for Pivot, not index bucket lifecycle. Option B is wrong because server.conf contains server-wide settings, not per-index bucket policies. Option D is wrong because inputs.conf defines data inputs, not index storage or lifecycle.

Full explanation →

MCQmedium

You are analyzing search performance using the Search Activity dashboard. You observe that 'Result Count' is extremely high for a specific saved search. Which optimization technique is most effective to reduce the load on the indexer?

A.Increase the memory allocation for the search head

B.Disable data model acceleration for the index

C.Use the | table command at the start

D.Use specific time ranges and selective filters at the beginning of the search

AnswerD

Applying specific time ranges and selective filters first reduces the volume of events retrieved from the indexers before the search pipeline runs. This directly addresses the high Result Count by shrinking the scanned dataset, cutting indexer load far more effectively than later-stage tuning.

Why this answer

To reduce the load on the indexer when a saved search returns an extremely high result count, the most effective optimization is to use specific time ranges and selective filters at the beginning of the search. This reduces the amount of data that the indexer must scan and process, directly lowering the load. Other options either do not address indexer load or are incorrect.

Exam trap

SPLK-2002 often tests search optimization techniques, and candidates may confuse search head memory with indexer load, or think that '| table' can be used early to reduce data.

How to eliminate wrong answers

Option A is wrong because increasing memory allocation for the search head does not reduce indexer load; it may improve search head performance but the indexer still processes the same amount of data. Option B is wrong because disabling data model acceleration would likely increase search load and slow down searches that rely on data models, not reduce it. Option C is wrong because using '| table' at the start of a search is not valid syntax; 'table' is a transforming command that should be used after the base search, and placing it early does not reduce indexer load.

Full explanation →

MCQmedium

You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?

A.Site-aware routing

B.Data locality

C.Load balancing

D.Search affinity

AnswerD

Search affinity routes searches to indexers in the same site as the search head, reducing cross-site traffic and latency. This satisfies the requirement to prioritise same-site searches. Other features, such as search head clustering replication or indexer discovery, address availability and distribution, not site-based prioritisation.

Why this answer

Search affinity is the Search Head Cluster feature that keeps a search on a search head located in the same site as the indexers holding the data, minimizing cross-site traffic. When search affinity is enabled, the SHC captain assigns searches to members based on the site of the indexers that own the relevant buckets. This is distinct from indexer discovery or site-aware routing, which operate at the indexer/forwarder layer rather than the search head layer.

Exam trap

The trap here is confusing search affinity with indexer-side site awareness or generic load balancing; candidates pick 'site-aware routing' because it sounds correct, but the SHC feature is specifically named search affinity.

How to eliminate wrong answers

Option A is wrong because 'site-aware routing' is not a Splunk SHC feature name; site awareness exists for indexers and multisite clustering, but the SHC search placement feature is called search affinity. Option B is wrong because data locality is a general concept (keeping compute near data) and is not the specific Splunk SHC configuration knob. Option C is wrong because load balancing distributes searches across SHC members for capacity, not for site proximity to indexers.

Full explanation →

MCQeasy

You are monitoring indexer performance. Which metric in the Monitoring Console's 'Indexing Performance' dashboard best indicates a bottleneck in the ingestion pipeline?

A.Disk Read IOPS

B.Memory Usage

C.CPU Usage

D.Average Queue Fill Percentage

AnswerD

Average Queue Fill Percentage shows how full the ingestion queues are over time. A persistently high value indicates the indexers cannot consume data as fast as it arrives, pinpointing a bottleneck in the ingestion pipeline rather than in search or disk performance.

Why this answer

The Average Queue Fill Percentage metric in the Indexing Performance dashboard directly measures how full the indexing pipeline queues are. A persistently high or rising queue fill percentage indicates that events are arriving faster than the indexers can process them, which is the clearest signal of an ingestion bottleneck. Disk, memory, and CPU metrics can be symptoms, but queue fill is the direct indicator of pipeline backpressure.

Exam trap

SPLK-2002 often tests whether candidates can distinguish direct pipeline indicators from generic resource metrics, so CPU and memory options look plausible to anyone who equates 'bottleneck' with 'high resource usage'.

How to eliminate wrong answers

Option A is wrong because Disk Read IOPS reflects storage read activity and is more relevant to search performance or bucket replication than to ingestion pipeline saturation. Option B is wrong because Memory Usage is a resource metric that may be high for many reasons and does not directly indicate ingestion backpressure. Option C is wrong because CPU Usage is a general resource metric; high CPU can slow indexing but does not by itself prove a pipeline bottleneck, whereas queue fill does.

Full explanation →

MCQmedium

When using a Search Head Cluster, what is the purpose of the 'captain'?

A.To act as the Cluster Master for indexers.

B.To store all bucket data for the indexers.

C.To receive data from forwarders.

D.To distribute search results to the end user.

E.To coordinate search scheduling and replicate configuration bundles.

AnswerE

The captain is the elected Search Head Cluster member that runs the scheduler and replicates configuration bundles to peers, satisfying the stem's coordination requirement. This centralises search artefact distribution while other members handle user searches, with re-election on failure.

Why this answer

The captain in a Search Head Cluster coordinates search scheduling and replicates configuration bundles across the cluster members, ensuring consistent search execution and configuration. This is why option E is correct.

Exam trap

SPLK-2002 often tests the confusion between the roles of Cluster Master (for indexers) and Captain (for search head clusters), leading candidates to pick the wrong answer.

How to eliminate wrong answers

Option A is wrong because the Cluster Master is a separate role for indexer clusters, not search head clusters. Option B is wrong because bucket data is stored on indexers, not on the search head cluster captain. Option C is wrong because receiving data from forwarders is the role of indexers or heavy forwarders, not the search head cluster captain.

Option D is wrong because distributing search results to end users is handled by the search head that initiated the search, not specifically the captain.

Full explanation →

Multi-Selecthard

You are investigating why an indexer node is not reporting to the Cluster Master. Which THREE of the following are the most likely causes?

Select 3 answers

A.The indexer has too many warm buckets

B.The security key ('pass4SymmKey') is mismatched

C.The management port is blocked by a firewall

D.The replication port is blocked by a firewall

E.The indexer instance is not running the 'cluster-member' role

AnswersB, C, E

Cluster peers authenticate with the shared pass4SymmKey; if the indexer's key differs from the master's, the peer handshake fails and the node never appears as a cluster member. A mismatch therefore directly prevents reporting, satisfying the stem's requirement for a likely cause.

Why this answer

Option B is correct because the pass4SymmKey in the [clustering] stanza of server.conf must match across all cluster members and the master; a mismatch prevents the indexer from authenticating and registering with the Cluster Master. Option C is correct because indexers communicate with the master over the management port (default 8089), so a firewall blocking that port stops the indexer from reporting its status. Option E is correct because an indexer must be configured with the cluster-member role (mode = slave in [clustering]) to join and report to the master; without it, the instance never registers.

Option A is not a cause because warm bucket count affects disk usage and search performance, not cluster registration. Option D is not a cause because the replication port (default 9887) is used for peer-to-peer bucket replication between indexers, not for reporting to the Cluster Master.

Exam trap

SPLK-2002 often tests the distinction between the management port (8089, for Master-peer communication) and the replication port (9887, for peer-to-peer bucket replication), causing candidates to select the wrong port as the cause of reporting failures.

Full explanation →

MCQeasy

What is the primary function of the 'Cluster Master' in an Indexer Cluster?

A.To handle incoming data from universal forwarders

B.To manage the indexer cluster's configuration and bucket state

C.To serve the Splunk user interface

D.To search across all indexers

AnswerB

The Cluster Master manages the indexer cluster's configuration and bucket state, satisfying the stem's requirement for its primary function. It coordinates replication and search factors, instructs peers on bucket fix-up, and maintains the cluster's overall health, rather than handling search requests or indexing data itself.

Why this answer

The Cluster Master (now called Cluster Manager in newer versions) in an Indexer Cluster is responsible for managing the cluster's configuration and bucket state. It coordinates replication, tells indexers which buckets to replicate, manages search affinity, and handles peer registration. It does not handle data ingestion or serve the UI.

Exam trap

SPLK-2002 often tests the misconception that the cluster master handles data ingestion or search, when its primary role is configuration and bucket state management.

How to eliminate wrong answers

Option A is wrong because handling incoming data from universal forwarders is the role of indexers (or heavy forwarders), not the cluster master. Option C is wrong because serving the Splunk user interface is done by the search head, not the cluster master. Option D is wrong because searching across all indexers is performed by the search head, which distributes the search to indexers; the cluster master does not search.

Full explanation →

Multi-Selecthard

You are troubleshooting slow search performance across the indexer cluster. Which THREE of the following could be potential causes?

Select 3 answers

A.The indexers have high CPU usage

B.The KV store on the search head is disabled

C.Search concurrency limits are being reached on the search head

D.The indexer cluster is currently re-balancing buckets

E.The Splunk license is close to the daily limit

AnswersA, C, D

Splunk search performance depends on indexer CPU headroom for search processing and result aggregation. Sustained high CPU usage starves search processes, queuing and slowing queries across the cluster, directly explaining the slow search performance described in the stem.

Why this answer

Option A is correct because high CPU usage on the indexers directly degrades search performance, as indexers must parse, search, and return results from buckets, and CPU saturation slows query processing and result aggregation. Option C is correct because when search concurrency limits are reached on the search head, additional searches are queued or throttled, which manifests as slow search performance for users. Option D is correct because bucket re-balancing in an indexer cluster involves copying and moving buckets between peers, consuming disk I/O, network bandwidth, and CPU, which competes with search workloads and slows them down.

Option B is not correct because the KV store on the search head supports features like saved searches, lookups, and knowledge objects, but disabling it does not directly cause slow search performance across the indexer cluster. Option E is not correct because approaching the daily license limit triggers license violations and search warnings or blocking, but it is not a direct cause of slow search performance.

Exam trap

SPLK-2002 often tests the distinction between direct performance bottlenecks (CPU, concurrency, rebalancing) and indirect or non-performance issues (KV store, license limits), so candidates must identify which factors directly impact search speed.

Full explanation →

MCQmedium

What is the impact of having too many small buckets in an index?

A.Faster data rolling

B.Reduced disk space usage

C.Degraded search performance due to high overhead

D.Improved search performance

AnswerC

Excessive small buckets inflate the index's bucket count, forcing the search head to open and scan far more bucket metadata and TSIDX files per query. This overhead directly degrades search performance, satisfying the stem's constraint that bucket proliferation, not raw data volume, is the limiting factor.

Why this answer

Having too many small buckets in an index degrades search performance because each bucket must be opened and processed separately, leading to high overhead in terms of file handles, memory, and search initialization. Splunk searches across many small buckets require more resources and time compared to fewer, larger buckets. This is a common issue when buckets are rolled frequently due to small size limits.

Exam trap

SPLK-2002 often tests the relationship between bucket size and search performance; candidates may think smaller buckets are faster because they contain less data, but the overhead of many buckets outweighs the benefit.

How to eliminate wrong answers

Option A is wrong because faster data rolling is not an impact of having too many small buckets; in fact, too many small buckets may indicate that rolling is happening too frequently, which is a symptom, not a benefit. Option B is wrong because reduced disk space usage is not true; many small buckets can actually increase disk space usage due to per-bucket overhead (metadata, indexes). Option D is wrong because improved search performance is the opposite of what happens; search performance degrades.

Full explanation →

MCQeasy

What must be installed on all Search Head Cluster members before they can join the cluster?

A.A shared SSL certificate

B.A dedicated storage partition

C.A specialized Splunk App

D.The same security key

AnswerD

Every search head cluster member must hold an identical security key, which encrypts and authenticates replication and cluster traffic between members. Without the matching key, a search head cannot join or communicate within the cluster.

Why this answer

All Search Head Cluster members must share the same security key (also called the cluster key or passphrase) to authenticate and join the cluster. This key is set via the `splunk edit shcluster-config -secret` command or in `server.conf` under `[shclustering]` with the `pass4SymmKey` setting. Without an identical key, members cannot establish trust and will fail to form the cluster.

Exam trap

SPLK-2002 often tests the distinction between the security key and SSL certificates, as both are security-related and used in cluster communication, but only the security key is mandatory for joining.

How to eliminate wrong answers

Option A is wrong because while SSL certificates are used for secure communication between cluster members, they are not the prerequisite for joining; the security key is the authentication mechanism. Option B is wrong because a dedicated storage partition is not required for cluster membership; Splunk can use any available storage, though best practices recommend separate partitions for performance. Option C is wrong because no specialized Splunk App must be installed on all members before joining; the clustering is configured via built-in settings, not an app.

Full explanation →

100

Multi-Selecthard

Which THREE factors commonly cause high CPU utilization on indexers?

Select 3 answers

A.Excessive data model acceleration jobs

B.Complex, inefficient search queries

C.Network latency between indexers

D.Low disk space

E.High ingestion volume

AnswersA, B, E

Background summary searches are CPU intensive.

Why this answer

Option A is correct because data model acceleration runs scheduled searches that build and periodically rebuild summary datasets on the indexer, and these background jobs consume significant CPU cycles, especially with many accelerated models. Option B is correct because complex or inefficient search queries (heavy use of wildcards, large time ranges, expensive commands like transaction, join, or stats) force the indexer to process large volumes of events and drive CPU utilization up. Option E is correct because high ingestion volume increases parsing, indexing, and pipeline processing work on the indexer, which is CPU-intensive and scales directly with the amount of incoming data.

Option C does not belong because network latency affects search dispatch and data transfer speeds, not indexer CPU consumption. Option D does not belong because low disk space causes indexing to pause or block and triggers disk-related warnings, but it does not itself raise CPU utilization.

Exam trap

SPLK-2002 often tests the confusion between resource bottlenecks — candidates pick network latency or disk space thinking any resource constraint causes CPU spikes, when the question specifically asks about CPU utilization drivers.

Full explanation →

101

MCQmedium

You need to reduce the number of small buckets created in your index. Which parameter should you increase?

A.maxWarmDBCount

B.frozenTimePeriodInSecs

C.minHotBuckets

D.maxDataSize

AnswerD

maxDataSize sets the target size at which a bucket rolls to a new one; raising it lets each bucket hold more events before sealing, directly reducing the count of small buckets created in the index.

Why this answer

The maxDataSize parameter in indexes.conf controls the maximum size of a hot bucket before it rolls to warm. Increasing maxDataSize allows each bucket to hold more data, which reduces the total number of buckets created for a given volume of ingested data. This directly addresses the goal of reducing small buckets.

Exam trap

SPLK-2002 often tests whether candidates confuse bucket retention settings with bucket creation settings — the trap is picking maxWarmDBCount or frozenTimePeriodInSecs because they mention buckets, but only maxDataSize controls how large a bucket grows before rolling.

How to eliminate wrong answers

Option A is wrong because maxWarmDBCount limits how many warm buckets are retained before freezing or deleting the oldest; increasing it does not reduce bucket creation, it only changes retention of existing warm buckets. Option B is wrong because frozenTimePeriodInSecs defines the retention period (how long data is kept before freezing), which affects data lifecycle, not bucket count. Option C is wrong because minHotBuckets is not a standard indexes.conf parameter for controlling bucket creation; hot bucket behavior is governed by maxDataSize and related settings.

Full explanation →

102

MCQmedium

To optimize search performance, which feature should be enabled to allow Splunk to pre-calculate results for specific reports?

A.Summary indexing

B.Search acceleration

C.Parallel ingestion

D.Indexer clustering

AnswerB

Search acceleration pre-computes report results into summary indexes, so subsequent runs of the same report return cached data instead of re-scanning raw events. This directly satisfies the stem's requirement to pre-calculate results for specific reports, cutting search time and resource consumption.

Why this answer

Search acceleration (also called report acceleration) uses precomputed summaries stored in the index to speed up searches that match a saved report's base search. When enabled on a saved report, Splunk builds and maintains summary data so subsequent runs of that report or similar searches return results much faster. This is the feature specifically designed to pre-calculate results for reports.

Exam trap

SPLK-2002 often tests the distinction between summary indexing (manual, scheduled, writes to a summary index) and report acceleration (automatic, precomputed, tied to a saved report).

How to eliminate wrong answers

Option A is wrong because summary indexing is a manual method where you schedule a search to write results into a separate summary index using collect or si- commands; it is not an automatic pre-calculation feature tied to a report definition. Option C is wrong because parallel ingestion refers to ingesting data from multiple sources concurrently and has no bearing on pre-calculating report results. Option D is wrong because indexer clustering provides data replication and availability, not search result pre-calculation.

Full explanation →

103

Multi-Selecthard

An Indexer Cluster is in 'Maintenance Mode'. Which THREE of the following implications must be considered during this time?

Select 3 answers

A.The peers will continue to index incoming data normally

B.The Master will not alert on any missing buckets

C.The Master will force a bucket re-balance immediately

D.All searches will be automatically disabled

E.The Cluster Master will not perform bucket fix-up activities

AnswersA, B, E

During maintenance mode, peers keep indexing incoming data normally, so ingestion continues uninterrupted. The cluster simply suspends replication and searchability of new buckets until the maintenance window ends, meaning the constraint satisfied is continuous data ingestion while replication and search factors are temporarily relaxed.

Why this answer

In Splunk maintenance mode, option A is correct because the indexer peers keep indexing incoming data normally; maintenance mode only suppresses certain master-level activities, not data ingestion. Option B is correct because the cluster master stops alerting on missing buckets, so replication/primacy violations are not reported during this window. Option E is correct because the master also halts bucket fix-up activities, meaning it will not attempt to search for and replicate or restore missing bucket copies.

Option C is wrong because the master does not force an immediate bucket re-balance in maintenance mode; rebalancing is a separate, manual operation. Option D is wrong because searches are not automatically disabled by maintenance mode; search functionality continues unless separately restricted.

Exam trap

SPLK-2002 often tests the specific behaviors suspended during Maintenance Mode — candidates incorrectly assume that searches are disabled or that the master forces rebalancing, when in fact the master simply pauses bucket management while indexing and searching continue.

Full explanation →

104

Multi-Selectmedium

Which THREE metrics are critical for monitoring indexer health in the Monitoring Console?

Select 3 answers

A.Memory usage

B.Number of active apps

C.Number of logged-in users

D.Disk I/O latency

E.CPU utilization

AnswersA, D, E

Memory usage exposes indexer resource pressure: sustained high heap consumption triggers search-time degradation and can cause queue backup. Monitoring Console tracks this per indexer instance, letting you scale or rebalance before ingestion latency breaches the pipeline's throughput requirement.

Why this answer

Memory usage (A) is critical because indexers rely heavily on RAM for the index cache and search-time processing, and excessive memory pressure can cause swapping, slow searches, or crashes. Disk I/O latency (D) is critical because indexers continuously write buckets to disk and read them during searches, so high latency directly degrades indexing throughput and search performance. CPU utilization (E) is critical because indexing pipelines, search processing, and bucket merging are CPU-intensive, and sustained high utilization indicates the indexer is saturated.

The number of active apps (B) and number of logged-in users (C) are not indexer health metrics; they relate to user activity or app deployment rather than the performance and stability of the indexing tier.

Exam trap

SPLK-2002 often tests the difference between indexer health metrics and search head or general metrics, so candidates might incorrectly select user counts or app counts, which are not critical for indexer performance.

Full explanation →

105

MCQeasy

Which type of bucket is used for the most recent data and is generally searchable?

A.Warm

B.Cold

C.Frozen

D.Thawed

E.Hot

AnswerE

Hot buckets hold the most recent, actively written data and remain searchable, satisfying the stem's requirement for current, queryable events. As data ages it rolls to warm, then cold, then frozen, which are slower or archival, so only hot meets both the recency and searchability constraints.

Why this answer

Hot buckets contain the most recent, actively written data and are the only bucket type that is both writable and searchable in real time. When data ages or reaches a size threshold, hot buckets roll to warm, which are searchable but no longer written to. Therefore hot is the correct answer for 'most recent data and generally searchable.'

Exam trap

SPLK-2002 often tests bucket lifecycle ordering and searchability; candidates confuse 'warm' as the most recent because it is the first rolled bucket, but hot is the actively written, most recent bucket.

How to eliminate wrong answers

Option A is wrong because warm buckets contain older data that has already rolled from hot; they are searchable but are not the most recent. Option B is wrong because cold buckets hold even older data, are searchable but slower, and are candidates for archiving. Option C is wrong because frozen buckets are archived or deleted data that is no longer searchable unless thawed.

Option D is wrong because thawed buckets are restored from archive (frozen) and are searchable but are not the most recent data.

Full explanation →

106

Multi-Selecteasy

Which TWO items are stored in the index directory?

Select 2 answers

A.License master keys

B.TSIDX files

C.Raw data files (compressed)

D.Search logs

E.App configuration files

AnswersB, C

TSIDX files hold the time-series index that maps timestamped buckets to raw events, enabling Splunk to locate data within a specified time range. They reside in the index directory alongside bucket metadata, not in the search head or configuration directories.

Why this answer

In Splunk, the index directory (e.g., $SPLUNK_HOME/var/lib/splunk/defaultdb/db) stores the indexed data itself, which includes both the rawdata files (compressed journal slices) and the TSIDX files that hold the time-series index used to locate events quickly, so options B and C are correct. TSIDX files map timestamps and terms to the rawdata slices, and the rawdata files are the compressed, bucket-organized copies of the ingested events. License master keys are not stored in the index directory; they are managed by the license manager (in $SPLUNK_HOME/etc/licenses or the license pool configuration).

Search logs are written to $SPLUNK_HOME/var/log/splunk (e.g., search.log per search job), not the index directory. App configuration files live under $SPLUNK_HOME/etc/apps (and related etc directories), not in the index storage.

Exam trap

SPLK-2002 often tests the confusion between what lives in the index directory versus $SPLUNK_HOME/etc or var/log, so candidates incorrectly select configuration or log files as indexed data.

Full explanation →

107

MCQmedium

An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?

A.A local RAID 10 array

B.An S3-compatible object store

C.A network-attached storage (NAS) with NFS v4

D.A SAN with Fibre Channel connectivity

AnswerB

SmartStore caches bucket data locally while ageing cold buckets to remote storage, so the backend must expose an S3-compatible API; native S3, GCS or Azure Blob via gateway all qualify. This satisfies the stem's requirement for a remote object store rather than block or file storage.

Why this answer

SmartStore requires an S3-compatible object store as the remote storage tier because it uses the S3 API to upload and download bucket data (rawdata and tsidx) to remote storage while keeping only cache and metadata locally. Splunk supports Amazon S3, S3-compatible stores (e.g., MinIO, Dell ECS), Azure Blob, and GCS via the appropriate remote storage provider. Local RAID, NAS, or SAN do not expose the S3 API that SmartStore depends on.

Exam trap

SPLK-2002 often tests whether candidates confuse SmartStore's remote tier with traditional shared storage — the trap is selecting NAS/SAN because they are 'shared,' when SmartStore specifically requires an S3-compatible object store.

How to eliminate wrong answers

Option A is wrong because a local RAID 10 array is block storage attached to the indexer and cannot serve as the remote object store SmartStore requires — it also defeats the purpose of decoupling compute from storage. Option C is wrong because NFS v4 is a file-level protocol, not the S3 object API, and SmartStore does not support NFS as a remote volume. Option D is wrong because Fibre Channel SAN provides block-level LUNs, not S3-compatible object semantics, and is not a supported SmartStore backend.

Full explanation →

108

MCQmedium

An architect is designing an index lifecycle for compliance. The requirement is to keep data for exactly 7 years. Which setting must be configured to prevent premature deletion?

A.frozenTimePeriodInSecs

B.maxTotalDataSizeMB

C.maxWarmDBCount

D.maxHotSpanSecs

AnswerA

frozenTimePeriodInSecs defines the retention window in seconds before indexed buckets may be rolled to frozen and eventually deleted. Setting it to 220752000 seconds (7 years) prevents the indexer from archiving data prematurely, directly satisfying the exact seven-year compliance retention requirement.

Why this answer

frozenTimePeriodInSecs is the index-level setting in indexes.conf that defines the age (in seconds) at which buckets roll from cold to frozen, triggering deletion (or archival if a coldToFrozenScript/archiver is configured). Setting it to 7 years (220,752,000 seconds) ensures data is retained for exactly that period before being frozen. This is the only setting in the list that controls retention by time rather than by size or count.

Exam trap

SPLK-2002 often tests the confusion between time-based retention (frozenTimePeriodInSecs) and size/count-based retention (maxTotalDataSizeMB, maxWarmDBCount), tricking candidates into picking a size limit when the requirement is explicitly a time window.

How to eliminate wrong answers

Option B is wrong because maxTotalDataSizeMB controls retention by total index size in megabytes, not by time — it forces the oldest buckets to freeze once the size threshold is hit, which could delete data well before 7 years. Option C is wrong because maxWarmDBCount limits how many warm buckets can exist before the oldest rolls to cold; it governs warm-to-cold transitions, not the 7-year retention boundary. Option D is wrong because maxHotSpanSecs controls how long a hot bucket stays hot before rolling to warm, which is a lifecycle stage transition unrelated to long-term retention.

Full explanation →

109

MCQhard

What happens to a search job if the Search Head Cluster captain goes down during an active search?

A.The search head cluster becomes read-only.

B.Indexers stop processing data.

C.A new captain is elected and search jobs are recovered.

D.The entire cluster must be restarted.

E.The search job is canceled immediately.

AnswerC

Search Head Cluster members maintain replicated search artefacts and the captain role is elected dynamically. When the captain fails, a new captain is elected and in-flight search jobs are recovered from replicated state, so searches continue rather than being lost.

Why this answer

In a Search Head Cluster, the captain is a dynamically elected member that coordinates configuration replication and search scheduling. If the captain goes down, a new captain is elected from the remaining members, and active search jobs are recovered and continue. This provides high availability and fault tolerance.

Exam trap

The trap is thinking that the loss of the captain halts all searches or requires a restart, but the cluster is designed for automatic failover and job recovery.

How to eliminate wrong answers

Option A is wrong because the search head cluster does not become read-only; it continues to operate with a new captain. Option B is wrong because indexers are independent of the search head cluster captain; they continue processing data. Option D is wrong because a full cluster restart is not required; the cluster is designed for automatic failover.

Option E is wrong because search jobs are not canceled; they are recovered by the new captain.

Full explanation →

110

MCQhard

You are troubleshooting a KV store issue in an Indexer Cluster. Which command allows you to verify the status of the KV store and its replication on a node?

A.mongostat

B.splunk show kvstore-status

C.check_kvstore.py

D.splunk status kvstore

AnswerB

splunk show kvstore-status reports KV store status, replication, and node role on the queried node. This directly verifies both store health and replication across the indexer cluster, satisfying the troubleshooting requirement without inspecting configuration files.

Why this answer

The command 'splunk show kvstore-status' is the supported CLI command to display the KV Store status on a Splunk instance, including replication status, port, and storage engine details. It works on indexers, search heads, and cluster members, making it the correct tool for verifying KV Store health and replication in an Indexer Cluster.

Exam trap

SPLK-2002 often tests the exact CLI syntax for KV Store diagnostics, and candidates confuse it with MongoDB tools like mongostat or invent invalid commands like 'splunk status kvstore'.

How to eliminate wrong answers

Option A is wrong because mongostat is a MongoDB utility that shows live database operation counters, but it is not the Splunk-supported command for KV Store status and may not be available or properly configured in Splunk's bundled MongoDB. Option C is wrong because check_kvstore.py is not a standard Splunk command; while there are diagnostic scripts, the official CLI command is 'splunk show kvstore-status'. Option D is wrong because 'splunk status kvstore' is not valid syntax; the correct order is 'splunk show kvstore-status'.

Full explanation →

111

MCQmedium

When managing indexer clustering, what is the impact of a high 'replication_factor' on indexing performance?

A.Allows for faster data ingestion without resource constraints

B.Improves search speed by reducing data density

C.Increases indexing latency due to synchronous replication requirements

D.Decreases indexer storage requirements

AnswerC

A higher replication_factor forces each bucket to be copied to more peer indexers synchronously before indexing is acknowledged, so latency rises. This satisfies the stem's constraint that replication is synchronous, directly increasing indexing latency rather than throughput.

Why this answer

A high replication_factor means each bucket must be replicated to more indexer peers before the data is considered safely indexed. Because replication is synchronous for hot buckets in an indexer cluster, the indexing pipeline waits for acknowledgments from all required peers, increasing indexing latency. This is the direct performance impact.

Exam trap

SPLK-2002 often tests the trade-off between replication_factor and performance; candidates incorrectly assume higher replication improves speed or reduces storage, when it actually increases latency and storage usage.

How to eliminate wrong answers

Option A is wrong because a high replication factor does not allow faster ingestion; it adds replication overhead and resource consumption, slowing ingestion. Option B is wrong because replication factor does not affect search speed by reducing data density; search speed is influenced by search factor and bucket distribution, not replication factor. Option D is wrong because a higher replication factor increases storage requirements (more copies), not decreases them.

Full explanation →

112

MCQhard

An architect is troubleshooting a Splunk deployment where search head cluster members are unable to replicate the search head captain's knowledge bundle. The captain's log shows repeated errors about failing to push the bundle to a member. Which of the following is the most likely cause and the appropriate resolution?

A.The search head cluster members are using a different Splunk version than the captain; upgrade all members to match the captain's version.

B.The captain's management port (default 8089) is blocked by a firewall between the captain and the members; open the port to allow bundle replication.

C.The search head cluster members have insufficient disk space to store the knowledge bundle; free up disk space on the members.

D.The captain's replication factor for the knowledge bundle is set to 0; increase the replication factor to at least 1.

AnswerB

Search head cluster bundle replication uses the management port (8089) to transfer the knowledge bundle from the captain to the members. If a firewall blocks this port, the captain cannot push the bundle, resulting in the observed errors. Opening the port on the firewall ensures successful replication. This is a common issue in distributed environments with network segmentation.

Why this answer

In a search head cluster, the captain is responsible for replicating the knowledge bundle to all members. This replication occurs over the management port (8089 by default). If a firewall blocks this port between the captain and a member, the captain cannot push the bundle, leading to replication errors.

Ensuring the management port is open and accessible on all members resolves the issue. This is a common configuration oversight in environments with strict network policies.

Exam trap

The trap here is assuming that bundle replication uses the same port as data forwarding (9997) or the web port (8000), when it actually uses the management port (8089).

Full explanation →

113

MCQmedium

What is the effect of setting 'forwarder_site_failover=true' in the indexer discovery stanza?

A.It mandates the use of SSL.

B.It increases the replication factor.

C.Forwarders will stop sending data if the local site is down.

D.Forwarders can failover to indexers in another site.

E.The indexer discovery service is disabled.

AnswerD

Setting `forwarder_site_failover=true` lets universal forwarders switch to indexers in a different site when their local site's indexers become unavailable, satisfying the cross-site resilience requirement. Indexer discovery normally restricts forwarders to their own site; this parameter overrides that restriction, enabling failover across sites during an outage.

Why this answer

Setting `forwarder_site_failover=true` in the indexer discovery stanza enables forwarders to send data to indexers in another site if the local site's indexers are unavailable. This provides site-level redundancy and ensures data continues to flow during a site outage.

Exam trap

SPLK-2002 often tests the confusion between site failover and other settings like SSL or replication factor, leading candidates to select options that are unrelated to the failover behavior.

How to eliminate wrong answers

Option A is wrong because SSL usage is controlled by `sslCertPath` and `sslPassword` settings, not by `forwarder_site_failover`. Option B is wrong because the replication factor is a cluster-level setting on the indexer cluster, not affected by forwarder site failover. Option C is wrong because the setting enables failover, not stops data; forwarders will attempt to send to other sites.

Option E is wrong because indexer discovery remains enabled; this setting only controls failover behavior.

Full explanation →

114

MCQmedium

In an indexer cluster, what happens if the cluster master is permanently lost and you do not have a backup of the 'master-apps' directory?

A.The data is permanently lost

B.The indexers continue to work normally indefinitely

C.You will be unable to distribute new configuration updates

D.You can restore the configuration from the peer nodes

AnswerC

Without the master-apps backup, the new cluster master cannot recover the configuration bundle that replication distributes to peers. Configuration updates therefore fail to propagate, satisfying the stem's permanent-loss constraint. Peer data and search remain intact, but centralised configuration management is lost until the bundle is rebuilt manually.

Why this answer

The cluster master stores cluster-wide configuration in $SPLUNK_HOME/etc/master-apps, which is bundled and pushed to peers via the configuration replication mechanism. If the master is lost without a backup of master-apps, you can rebuild a master and rejoin peers, but the custom configurations (indexes, props, transforms, etc.) that were only on the master are gone, so you cannot distribute new or updated configuration bundles. Data itself resides on the peers and is not lost, and peers continue serving searches with their last-received configuration.

Exam trap

SPLK-2002 often tests the misconception that losing the cluster master causes data loss; in reality, data is on peers, and the real loss is the ability to distribute configuration updates.

How to eliminate wrong answers

Option A is wrong because indexed data lives on the peer nodes, not on the master; losing the master does not delete buckets. Option B is wrong because while peers keep running with their cached configuration, they cannot receive new configuration updates, and cluster management functions (fixup, rebalance, peer addition) are impaired. Option D is wrong because peers do not store the authoritative master-apps bundle; they only hold the replicated configuration they received, so you cannot reconstruct the master's full configuration set from them.

Full explanation →

115

MCQmedium

A user claims that a search is not returning data from a specific time range. You suspect the data has been rolled to cold storage and the cold storage is not being searched. Which configuration file controls which cold paths are included in the search?

A.indexes.conf

B.distsearch.conf

C.server.conf

D.limits.conf

AnswerA

This file defines the pathing and retention policies for the index.

Why this answer

The indexes.conf file defines index properties, including the paths for hot, warm, cold, and frozen buckets. The 'coldPath' setting specifies where cold buckets are stored, and Splunk searches these paths by default unless configured otherwise. Therefore, indexes.conf controls which cold paths are included in searches.

Exam trap

SPLK-2002 often tests which configuration file governs index storage paths, and candidates incorrectly choose limits.conf or server.conf, which control search limits and server settings respectively.

How to eliminate wrong answers

Option B is wrong because distsearch.conf configures distributed search settings such as search peers and replication, not index storage paths. Option C is wrong because server.conf controls general server settings like ports, SSL, and clustering, not index bucket paths. Option D is wrong because limits.conf sets search and indexing limits (e.g., max results, memory), not cold storage locations.

Full explanation →

116

MCQhard

In an indexer cluster, why might you use the 'splunk list cluster-peers' command?

A.To remove a node from the cluster

B.To update the license configuration

C.To verify the synchronization status of all indexer peers

D.To force a cluster rebalance

AnswerC

The command queries cluster peers and reports each peer's status, including whether it is up, down, or in a degraded replication state. This lets an administrator confirm that all indexer peers are synchronised and actively participating in bucket replication across the cluster.

Why this answer

The 'splunk list cluster-peers' command queries the cluster master and returns the status of all peer nodes, including whether each peer is Up, Down, or in a degraded state, along with its replication and searchability status. It is the standard CLI tool for verifying peer synchronization and health in an indexer cluster. It does not modify cluster state; it is read-only diagnostic output.

Exam trap

SPLK-2002 often tests whether candidates know the difference between read-only diagnostic commands (list cluster-peers) and state-changing commands (remove cluster-peers, rebalance cluster-data).

How to eliminate wrong answers

Option A is wrong because removing a node from the cluster is done with 'splunk remove cluster-peers' or by decommissioning, not with list. Option B is wrong because license configuration is managed via license manager commands and the licensing endpoint, not cluster-peers. Option D is wrong because forcing a rebalance is done with 'splunk rebalance cluster-data' or via the master's UI/API, not with list.

Full explanation →

117

MCQeasy

Which Splunk process is responsible for managing the indexer's disk I/O and bucket lifecycle?

A.splunkd

B.mongod

C.python

D.kvstore

AnswerA

splunkd is the single daemon managing all indexer operations, including disk I/O scheduling and the hot-to-warm-to-cold bucket lifecycle transitions. It satisfies the stem's requirement by being the process that owns both responsibilities, rather than a separate helper binary.

Why this answer

splunkd is the main Splunk daemon process that runs on all Splunk instances, including indexers, and is responsible for managing indexing, search, and various background tasks such as disk I/O and bucket lifecycle management. It handles the rolling of buckets from hot to warm to cold to frozen, as well as disk space monitoring.

Exam trap

SPLK-2002 often tests process responsibilities, and candidates may confuse splunkd with mongod or kvstore, especially since KV Store is prominent in Splunk 8.x and later.

How to eliminate wrong answers

Option B is wrong because mongod is the MongoDB process used by Splunk for the KV Store, which stores app configurations and lookups, not indexer disk I/O or bucket lifecycle. Option C is wrong because python is used for running Python-based scripts and custom search commands, not for managing indexer disk I/O. Option D is wrong because kvstore is a feature (backed by mongod) for storing key-value data, not a process that manages disk I/O or bucket lifecycle.

Full explanation →

118

MCQmedium

A Splunk architect is configuring a new index called `netflow` that must retain data for exactly 90 days, then delete it automatically. The index will receive high volume and is expected to grow significantly. Which setting in `indexes.conf` should the architect use to enforce this retention period, ensuring that buckets are removed from the index after 90 days?

A.frozenTimePeriodInSecs = 7776000

B.coldToFrozenScript = 7776000

C.maxDataSize = 7776000

D.homePath.maxDataSizeMB = 7776000

AnswerA

Setting `frozenTimePeriodInSecs` to 7776000 (90 days × 86400 seconds) instructs Splunk to roll buckets to frozen status after that age, and since no archival destination is configured, they are deleted. This directly enforces the required retention period for the `netflow` index, satisfying the exact 90-day deletion requirement.

Why this answer

Retention in Splunk is controlled by `frozenTimePeriodInSecs`, which defines the age at which buckets are frozen. For the `netflow` index, setting it to 7776000 seconds (90 days) ensures that buckets older than 90 days are moved to frozen status and, without a frozen archive, deleted. This matches the requirement precisely.

Exam trap

The trap here is confusing size-based limits like `maxDataSize` or `homePath.maxDataSizeMB` with time-based retention, which is exclusively governed by `frozenTimePeriodInSecs`.

Full explanation →

119

MCQeasy

Which configuration file is used to specify the disk path where index buckets are stored?

A.server.conf

B.outputs.conf

C.inputs.conf

D.indexes.conf

AnswerD

`indexes.conf` defines per-index storage settings, including `homePath` and `coldPath`, which set the disk paths where hot/warm and cold buckets reside. This directly satisfies the stem's requirement to specify the bucket storage location, since `server.conf` handles instance-level settings and `props.conf` governs parsing rather than index paths.

Why this answer

The indexes.conf file is the central configuration file for defining and managing indexes in Splunk. Within each index stanza, the 'homePath' setting specifies the directory where the index's hot and warm buckets are stored, and 'coldPath' specifies where cold buckets are stored. Therefore, indexes.conf is the correct file to specify the disk path for index buckets.

Exam trap

SPLK-2002 often tests the confusion between configuration files for data input, output, and indexing, leading candidates to mistakenly choose inputs.conf or outputs.conf when asked about index storage paths.

How to eliminate wrong answers

Option A is wrong because server.conf is used for general server settings such as server name, licensing, and clustering configuration, not for specifying index storage paths. Option B is wrong because outputs.conf configures forwarding destinations and data output settings, not index storage locations. Option C is wrong because inputs.conf defines data inputs and sources, not where index buckets are stored on disk.

Full explanation →

120

MCQeasy

Which tool is best for monitoring the health and performance of the entire Splunk environment?

A.Splunk CLI

B.Deployment Server

C.Monitoring Console

D.Splunk Web UI

AnswerC

Monitoring Console is Splunk's built-in tool for tracking health and performance across all components — indexers, search heads and forwarders — from one dashboard. It satisfies the stem's requirement to monitor the entire environment, unlike single-instance tools such as the search head's job inspector or the CLI.

Why this answer

The Monitoring Console (formerly known as the Distributed Management Console) is Splunk's built-in tool specifically designed to monitor the health, performance, and topology of an entire Splunk deployment. It provides dashboards for indexing, search, resource usage, and license usage across all components. It is the recommended tool for holistic environment monitoring.

Exam trap

The trap here is confusing the Monitoring Console with the general Splunk Web UI or the Deployment Server, as candidates may think any centralized interface can monitor health, but only the Monitoring Console is purpose-built for that.

How to eliminate wrong answers

Option A is wrong because the Splunk CLI is used for configuration, administration, and troubleshooting individual instances, not for holistic health monitoring of the entire environment. Option B is wrong because the Deployment Server is used to push configurations and apps to forwarders, not to monitor health. Option D is wrong because the Splunk Web UI is a general interface for searching and administration, but it does not provide the centralized health monitoring dashboards that the Monitoring Console offers.

Full explanation →

121

MCQhard

When using a load balancer in front of a search head cluster, why is session affinity (sticky sessions) recommended?

A.To increase the replication speed.

B.To prevent unauthorized access.

C.To improve indexing performance.

D.To maintain session persistence and search job state.

E.To reduce the number of license tokens.

AnswerD

Sticky sessions bind each client to one cluster member via the load balancer, so the search job's artefacts and replication state remain on that node. Without affinity, subsequent requests could hit another member lacking the job's state, breaking search continuity.

Why this answer

Session affinity (sticky sessions) ensures that all requests from a given client are routed to the same search head for the duration of a session. In a Splunk search head cluster, search jobs and their artifacts (results, job state, dispatch directory) are stored locally on the search head that initiated the job. If a subsequent request lands on a different search head, that node has no knowledge of the job, causing errors or lost results.

Sticky sessions preserve the mapping between the client and the search head that owns the job.

Exam trap

The trap is confusing session affinity with high availability or load distribution — candidates may think sticky sessions improve performance or security, when the real reason is preserving search job state on a specific search head.

How to eliminate wrong answers

Option A is wrong because replication speed is determined by the replication factor and network bandwidth between cluster members, not by load balancer session affinity. Option B is wrong because preventing unauthorized access is the job of authentication and authorization mechanisms (LDAP, SAML, RBAC), not session affinity. Option C is wrong because indexing performance is handled by indexers and is unrelated to how the load balancer distributes search head traffic.

Option E is wrong because license token consumption is governed by daily indexing volume and license configuration, not by session affinity.

Full explanation →

122

MCQhard

When configuring search affinity for a multi-site cluster, what is the behavior if no indexers are available in the local site?

A.The search fails immediately.

B.The search head queries indexers in other sites.

C.The search head waits for the local indexer to return.

D.The search head only returns partial results.

E.The search head reports an error to the user.

AnswerB

Search affinity prefers local-site indexers, but when none are available the search head falls back to indexers in other sites rather than failing. This preserves search availability across the multi-site cluster, satisfying the stem's scenario of local-site unavailability.

Why this answer

In a Splunk multi-site cluster, search affinity is a performance optimization that prefers indexers in the same site as the search head to reduce latency and WAN traffic. However, it is not a hard constraint: if no indexers in the local site are available (e.g., all are down, busy, or in maintenance mode), the search head automatically falls back to querying indexers in other sites. This ensures search continuity and availability, which is a core design goal of Splunk's distributed search architecture.

Exam trap

SPLK-2002 often tests the misconception that search affinity is a strict requirement, leading candidates to incorrectly choose options that suggest search failure or waiting, when in fact Splunk automatically falls back to remote sites.

How to eliminate wrong answers

Option A is wrong because search affinity is a preference, not a requirement; Splunk is designed for high availability and will not fail a search simply because local indexers are unavailable. Option C is wrong because the search head does not block or wait indefinitely for local indexers to return; it actively redirects the search to remote sites to avoid delays. Option D is wrong because the search head does not return partial results; it queries remote indexers to retrieve the complete result set.

Option E is wrong because no error is reported to the user; the fallback to remote sites is transparent and automatic.

Full explanation →

123

Multi-Selecthard

Which THREE factors should be considered when planning the hardware requirements for a multisite indexer cluster?

Select 3 answers

A.Disk I/O throughput

B.The color of the server chassis

C.Inter-site network latency and bandwidth

D.The total number of indexer peers

E.The number of concurrent web users

AnswersA, C, D

Disk I/O throughput directly governs indexing and search performance, since indexers constantly read and write bucket data. In a multisite cluster, replication and searchable copy factors multiply this load across sites, so sustained throughput per indexer must be sized against peak ingest plus inter-site replication traffic.

Why this answer

Option A (Disk I/O throughput) is correct because indexers must sustain high-throughput writes for incoming data and fast reads for searches, so IOPS and disk latency directly determine indexing and search performance. Option C (Inter-site network latency and bandwidth) is correct because in a multisite indexer cluster, replication and searchable-copy traffic crosses sites, and WAN latency/bandwidth affects replication factor satisfaction, search affinity, and site failover behavior. Option D (The total number of indexer peers) is correct because the number of peers determines replication and search factor distribution across sites, quorum requirements, and the aggregate storage/CPU capacity needed to hold replicated buckets.

Option B (chassis color) is irrelevant since it has no bearing on performance, capacity, or cluster topology. Option E (number of concurrent web users) is not a hardware-sizing factor for the indexer cluster itself; user count affects search load indirectly, but the question asks about indexer cluster hardware planning, which is driven by data volume, replication/search factors, and peer count.

Exam trap

SPLK-2002 often tests the confusion between indexer hardware factors and search head or user-related factors, tempting candidates to select user count as a hardware consideration for indexers when it is not a primary driver.

Full explanation →

Splunk Enterprise Certified Architect (SPLK-2002) (SPLK-2002) (SPLK-2002) — Questions 76–123