SPLK-2002 · domain
High Availability And Distributed Search
This domain covers indexer clustering and search head clustering in Splunk Enterprise: replication and search factors, bucket lifecycle and fixup, captain election, cluster monitoring endpoints, and distributed search behavior. Questions test whether you can reason about failure modes, data availability, and the CLI/REST tools used to inspect cluster health.
Focused practice
Practice High Availability And Distributed Search questions
Scored sessions drawing only from this domain — pick a length below.
What this domain covers
What to know about High Availability And Distributed Search
Be able to read cluster health with splunk show cluster-status and the manager REST endpoints, and explain bucket types and fixup. The single most important thing: know how replication_factor and search_factor differ and what each guarantees about data availability and searchability.
Indexer cluster monitoring via splunk show cluster-status, the manager's /services/cluster/manager endpoints, and the monitoring console
Bucket types and lifecycle: hot, warm, cold, frozen, and their searchability and replication states
Search head cluster captain election, member heartbeats, and causes of members losing contact with the captain
Consequences of low replication_factor and search_factor on data availability, searchability, and primary copy placement
Watch out for
Common High Availability And Distributed Search exam traps
- ▸Confusing replication_factor with search_factor: replication governs copies of buckets across peers, search_factor governs how many peers must host searchable copies
- ▸Assuming a hot bucket is replicated immediately; hot buckets are searchable but replication of a bucket completes when it rolls to warm
- ▸Treating the cluster manager as a search peer or captain; it coordinates replication and bucket fixup but does not serve search results
Question index
All High Availability And Distributed Search questions (22)
Click any question to see the full explanation, or start a practice session above.
When adding a new indexer to an existing Indexer Cluster, what is the best practice to ensure the indexer is ready before it starts receiving data?
Medium2Which component is responsible for distributing configuration bundles to indexers in a cluster?
Easy3A Splunk architect is deploying an Indexer Cluster with site awareness. The cluster has three sites: site1, site2, and site3. The replication factor is 3, and the search factor is 2. The architect wants to ensure that searchable copies are distributed across sites for high availability. Which of the following configurations should be applied?
Medium4What is the recommended method to distribute configuration changes across a Search Head Cluster?
Easy5In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?
Easy6Which THREE of the following are risks if the replication_factor is too low?
Hard7Which TWO of the following are features of the Indexer Cluster Master?
Medium8Which THREE of the following are key components of a disaster recovery plan for Splunk?
Easy9What is the primary function of the 'Cluster Secret' in a Splunk Indexer Cluster?
Easy10Which TWO of the following are valid ways to monitor the status of an Indexer Cluster?
Easy11A Splunk architect is designing a Search Head Cluster (SHC) with five members. The customer requires that searches continue to run even if the captain is unavailable. Which of the following best describes the captain election process and the impact on search activity?
Hard12If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?
Hard13Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?
Medium14What is the recommended way to handle an indexer peer that is permanently failing in an Indexer Cluster?
Medium15Which command is used to check the health of an Indexer Cluster from the Cluster Master CLI?
Easy16You notice that your indexer cluster has 'Streaming' buckets that are not yet searchable. What is the most likely cause?
Hard17When using a Search Head Cluster, what is the purpose of the 'captain'?
Medium18Which type of bucket is used for the most recent data and is generally searchable?
Easy19What happens to a search job if the Search Head Cluster captain goes down during an active search?
Hard20What is the effect of setting 'forwarder_site_failover=true' in the indexer discovery stanza?
Medium21When using a load balancer in front of a search head cluster, why is session affinity (sticky sessions) recommended?
Hard22When configuring search affinity for a multi-site cluster, what is the behavior if no indexers are available in the local site?
HardOther domains
All SPLK-2002 exam domains
Frequently asked questions
- What does the High Availability And Distributed Search domain cover on the SPLK-2002 exam?
- Be able to read cluster health with splunk show cluster-status and the manager REST endpoints, and explain bucket types and fixup. The single most important thing: know how replication_factor and search_factor differ and what each guarantees about data availability and searchability.
- How many questions are in this domain?
- This page lists all 22 High Availability And Distributed Search questions in the SPLK-2002 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only High Availability And Distributed Search questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.