SPLK-2002 Practice Questions

Question 1

What is the primary function of the 'Cluster Master' in an Indexer Cluster?

Accepted Answer

To manage the indexer cluster's configuration and bucket state. The Cluster Master (now called Cluster Manager in newer versions) in an Indexer Cluster is responsible for managing the cluster's configuration and bucket state. It coordinates replication, tells indexers which buckets to replicate, manages search affinity, and handles peer registration. It does not handle data ingestion or serve the UI.

Answer

To handle incoming data from universal forwarders

Answer

To serve the Splunk user interface

Answer

To search across all indexers

Question 2

Which TWO of the following are valid ways to monitor the status of an Indexer Cluster?

Accepted Answer

Using the CLI command 'splunk show cluster-status'.. Option B is correct because the Splunk CLI command 'splunk show cluster-status' (run on a cluster manager or member) reports the health and status of the indexer cluster, including peer and search head connectivity and replication status. Option C is correct because the Monitoring Console provides a dedicated Indexer Clustering dashboard that surfaces cluster health, peer status, replication and search factor compliance, and bucket-fixup activity. Option A is incorrect because license usage logs track license consumption, not cluster health or peer status. Option D is incorrect because forwarder logs show data forwarding activity and connectivity from the forwarder's perspective, not the status of the indexer cluster itself. Option E is incorrect because running a search on indexers tests search functionality but does not provide a valid, supported method for monitoring overall indexer cluster status.

Answer

Checking the license usage logs.

Answer

Reviewing the forwarder logs.

Answer

Running a search on the indexers directly.

Question 3

You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?

Accepted Answer

Use the local/ directory for configuration files that should not be replicated. In a Search Head Cluster, configurations are replicated from the deployer or captain via bundles, but files in the local/ directory of an app or system are not replicated and are preserved on each member. To keep local user configurations from being overwritten by cluster-wide bundles, you place them in the local/ directory, which takes precedence and is not overwritten by replicated configurations.

Answer

Move files to the var/run directory

Answer

Set the configuration to immutable in server.conf

Answer

Use the shcluster/ directory

Question 4

When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?

Accepted Answer

To define the number of copies of search artifacts. In an SHC, the replication_factor defines how many copies of the search-related configurations are replicated across members.

Answer

To limit the number of users

Answer

To specify the number of search nodes in the cluster

Answer

To balance the search load across nodes

Question 5

Which type of bucket is used for the most recent data and is generally searchable?

Accepted Answer

Hot. Hot buckets contain the most recent, actively written data and are the only bucket type that is both writable and searchable in real time. When data ages or reaches a size threshold, hot buckets roll to warm, which are searchable but no longer written to. Therefore hot is the correct answer for 'most recent data and generally searchable.'

Answer

Warm

Answer

Cold

Answer

Frozen

Answer

Thawed

Question 6

An architect is tasked with enabling SmartStore for an indexer cluster. What is the primary requirement for the remote storage backend?

Accepted Answer

An S3-compatible object store. SmartStore requires an S3-compatible object store as the remote storage tier because it uses the S3 API to upload and download bucket data (rawdata and tsidx) to remote storage while keeping only cache and metadata locally. Splunk supports Amazon S3, S3-compatible stores (e.g., MinIO, Dell ECS), Azure Blob, and GCS via the appropriate remote storage provider. Local RAID, NAS, or SAN do not expose the S3 API that SmartStore depends on.

Answer

A local RAID 10 array

Answer

A network-attached storage (NAS) with NFS v4

Answer

A SAN with Fibre Channel connectivity

Question 7

If a search head is overloaded with concurrent searches, what is the best strategy to offload the processing?

Accepted Answer

Implement a Search Head Cluster. A Search Head Cluster distributes search workload across multiple search head members, allowing concurrent searches to be load-balanced and providing horizontal scaling for search processing. This directly addresses an overloaded single search head by adding capacity and redundancy. Increasing indexers or indexer memory addresses indexing/search execution at the indexer layer, not the search head's concurrency bottleneck.

Answer

Increase the number of indexers

Answer

Reduce the number of users

Answer

Increase indexer memory

Question 8

An architect is designing an index lifecycle for compliance. The requirement is to keep data for exactly 7 years. Which setting must be configured to prevent premature deletion?

Accepted Answer

frozenTimePeriodInSecs. frozenTimePeriodInSecs is the index-level setting in indexes.conf that defines the age (in seconds) at which buckets roll from cold to frozen, triggering deletion (or archival if a coldToFrozenScript/archiver is configured). Setting it to 7 years (220,752,000 seconds) ensures data is retained for exactly that period before being frozen. This is the only setting in the list that controls retention by time rather than by size or count.

Answer

maxTotalDataSizeMB

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Question 9

You are troubleshooting a KV store issue in an Indexer Cluster. Which command allows you to verify the status of the KV store and its replication on a node?

Accepted Answer

splunk show kvstore-status. The command 'splunk show kvstore-status' is the supported CLI command to display the KV Store status on a Splunk instance, including replication status, port, and storage engine details. It works on indexers, search heads, and cluster members, making it the correct tool for verifying KV Store health and replication in an Indexer Cluster.

Answer

mongostat

Answer

check_kvstore.py

Answer

splunk status kvstore

Question 10

Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?

Accepted Answer

Service load is too high causing timeouts.. Option A is correct because a Search Head Cluster member under excessive service load can fail to respond to the captain's periodic heartbeats within the configured timeout, causing the captain to mark it as down and lose contact. Option D is correct because network instability (packet loss, latency, or intermittent connectivity) disrupts the heartbeat and replication traffic between members and the captain, breaking the cluster communication. Option E is correct because the captain and members communicate over the replication port (default 9887), so if a firewall blocks that port, the member cannot exchange heartbeats or replicate artifacts and loses contact with the captain. Option B is not a cause because the license master is unrelated to SHC captain heartbeat communication; a member can remain in contact with the captain even if licensing is unavailable. Option C is not a cause because indexer cluster load affects search and indexing performance, not the SHC internal captain-member heartbeat channel.

Answer

License master is offline.

Answer

The indexer cluster is busy.

Question 11

In an Indexer Cluster, which component stores the 'bucket' index files?

Accepted Answer

Indexer Peer. In a Splunk Indexer Cluster, the indexer peers are the nodes that actually receive, index, and store the raw data in the form of buckets. Buckets are directories containing rawdata, index files, and metadata, and they reside on the indexer peers' filesystems. The cluster master coordinates replication and searchability, but it does not store the bucket files themselves.

Answer

Search Head

Answer

Cluster Master

Answer

Deployment Server

Question 12

You are using the Monitoring Console to view the 'Search Head Clustering: Status' dashboard. You see that one of the nodes is showing as 'Missing'. What does this status imply?

Accepted Answer

The captain has not received a heartbeat from the node. In the Search Head Clustering: Status dashboard, a node showing 'Missing' means the cluster captain has not received a heartbeat from that node within the expected interval. The captain tracks member health via heartbeats, and a missing heartbeat indicates the node is unreachable, down, or partitioned from the cluster. This is a connectivity/health signal, not a performance or licensing state.

Answer

The node is overloaded

Answer

The node is in maintenance mode

Answer

The node has an invalid license

Question 13

You are tasked with verifying the health of the indexer cluster. Which dashboard in the Monitoring Console provides a high-level overview of the health of all indexer nodes, including their replication status?

Accepted Answer

Indexer Cluster: Status. The Monitoring Console's 'Indexer Cluster: Status' dashboard is purpose-built to show a high-level health view of all indexer cluster nodes, including peer status, replication and search factor compliance, and bucket replication status. It aggregates cluster health so you can quickly see whether the cluster is fully replicated and whether any peers are down or lagging. The other dashboards focus on performance, resource usage, or distributed search rather than cluster replication health.

Answer

Indexing Performance: Cluster

Answer

Resource Usage: Indexer Cluster

Answer

Distributed Search: Status

Question 14

You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?

Accepted Answer

Search affinity. Search affinity is the Search Head Cluster feature that keeps a search on a search head located in the same site as the indexers holding the data, minimizing cross-site traffic. When search affinity is enabled, the SHC captain assigns searches to members based on the site of the indexers that own the relevant buckets. This is distinct from indexer discovery or site-aware routing, which operate at the indexer/forwarder layer rather than the search head layer.

Answer

Site-aware routing

Answer

Data locality

Answer

Load balancing

Question 15

A user claims that a search is not returning data from a specific time range. You suspect the data has been rolled to cold storage and the cold storage is not being searched. Which configuration file controls which cold paths are included in the search?

Accepted Answer

indexes.conf. The indexes.conf file defines index properties, including the paths for hot, warm, cold, and frozen buckets. The 'coldPath' setting specifies where cold buckets are stored, and Splunk searches these paths by default unless configured otherwise. Therefore, indexes.conf controls which cold paths are included in searches.

Answer

distsearch.conf

Answer

server.conf

Answer

limits.conf

Splunk Enterprise Certified Architect SPLK-2002 practice test

Three ways to study

Study SPLK-2002 by domain

Study SPLK-2002 by topic

Deployment Architecture And Clustering practice questions

Performance Tuning practice questions

Data Lifecycle Management practice questions

High Availability And Distributed Search practice questions

Troubleshooting And Operations practice questions

SPLK-2002 fundamentals practice questions

SPLK-2002 scenario practice questions

SPLK-2002 troubleshooting practice questions

Splunk Enterprise Certified Architect (SPLK-2002) (SPLK-2002) practice questions