Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 11:

  Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

  A. Free licenses do not support clustering.
  B. Replicated data does not count against licensing.
  C. Each cluster member requires its own clustering license.
  D. Cluster members must share the same license pool and license master.
  B. Replicated data does not count against licensing.
  D. Cluster members must share the same license pool and license master.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Distdeploylicenses

• Question 12:

  When should multiple search pipelines be enabled?

  A. Only if disk IOPS is at 800 or better.
  B. Only if there are fewer than twelve concurrent users.
  C. Only if running Splunk Enterprise version 6.6 or later.
  D. Only if CPU and memory resources are significantly under-utilized.
  D. Only if CPU and memory resources are significantly under-utilized.

  ---

  Reference: https://answers.splunk.com/answers/617608/can-we-increase-parallelingestionpipelines-in-a-he.html

• Question 13:

  Which of the following is a way to exclude search artifacts when creating a diag?

  A. SPLUNK_HOME/bin/splunk diag --exclude
  B. SPLUNK_HOME/bin/splunk diag --debug --refresh
  C. SPLUNK_HOME/bin/splunk diag --disable=dispatch
  D. SPLUNK_HOME/bin/splunk diag --filter-searchstrings
  A. SPLUNK_HOME/bin/splunk diag --exclude

  ---

  Reference: https://splunkonbigdata.com/2018/10/01/splunk-diag/

• Question 14:

  When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

  A. 1. Delete Splunk Enterprise, if it exists. 2. Install and initialize the instance. 3. Join the SHC.
  B. 1. Install and initialize the instance. 2. Delete Splunk Enterprise, if it exists. 3. Join the SHC.
  C. 1. Initialize cluster rebalance operation. 2. Remove master node from cluster. 3. Trigger replication.
  D. 1. Trigger replication. 2. Remove master node from cluster. 3. Initialize cluster rebalance operation.
  B. 1. Install and initialize the instance. 2. Delete Splunk Enterprise, if it exists. 3. Join the SHC.

• Question 15:

  Which of the following can a Splunk diag contain?

  A. Search history, Splunk users and their roles, running processes, indexed data
  B. Server specs, current open connections, internal Splunk log files, index listings
  C. KV store listings, internal Splunk log files, search peer bundles listings, indexed data
  D. Splunk platform configuration details, Splunk users and their roles, current open connections, index listings
  B. Server specs, current open connections, internal Splunk log files, index listings

  ---

  Reference: https://splunkonbigdata.com/2018/10/01/splunk-diag/

• Question 16:

  When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

  A. Index and .tsidx files.
  B. Rawdata and index files.
  C. Compressed and .tsidx files.
  D. Compressed and meta data files.
  B. Rawdata and index files.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Aboutindexesandindexers

• Question 17:

  In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

  A. SPLUNK_HOME/var/lib/searchpeers
  B. SPLUNK_HOME/var/log/searchpeers
  C. SPLUNK_HOME/var/run/searchpeers
  D. SPLUNK_HOME/var/spool/searchpeers
  C. SPLUNK_HOME/var/run/searchpeers

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Whatsearchheadssend

• Question 18:

  Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

  A. Increase the maximum number of hot buckets in indexes.conf
  B. Increase the number of parallel ingestion pipelines in server.conf
  C. Decrease the maximum size of the search pipelines in limits.conf
  D. Decrease the maximum concurrent scheduled searches in limits.conf
  D. Decrease the maximum concurrent scheduled searches in limits.conf

• Question 19:

  In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)

  A. Use the Monitoring Console.
  B. Use the Search Head Clustering settings menu from Splunk Web on any member.
  C. Run the splunk transfer shcluster-captain command from the current captain.
  D. Run the splunk transfer shcluster-captain command from the member you would like to become the captain.
  B. Use the Search Head Clustering settings menu from Splunk Web on any member.
  D. Run the splunk transfer shcluster-captain command from the member you would like to become the captain.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Transfercaptain

• Question 20:

  To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

  A. Indexers
  B. Forwarders
  C. Search head
  D. Cluster master
  A. Indexers
  B. Forwarders

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Pipelinesets