Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 21:

  In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

  A. site_search_factor = origin:2, site1:2, total:4
  B. site_search_factor = origin:2, site2:1, total:4
  C. site_replication_factor = origin:2, site1:2, total:4
  D. site_replication_factor = origin:2, site2:1, total:4
  D. site_replication_factor = origin:2, site2:1, total:4

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Sitereplicationfactor

• Question 22:

  Which server.conf attribute should be added to the master node's server.conf file when decommissioning a site in an indexer cluster?

  A. site_mappings
  B. available_sites
  C. site_search_factor
  D. site_replication_factor
  A. site_mappings

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Decommissionasite

• Question 23:

  Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

  A. Replace the indexer storage to solid state drives (SSD).
  B. Add more search heads and redistribute users based on the search type.
  C. Look for slow searches and reschedule them to run during an off-peak time.
  D. Add more search peers and make sure forwarders distribute data evenly across all indexers.
  C. Look for slow searches and reschedule them to run during an off-peak time.

• Question 24:

  Which command is used for thawing the archive bucket?

  A. Splunk collect
  B. Splunk convert
  C. Splunk rebuild
  D. Splunk dbinspect
  C. Splunk rebuild

  ---

  Reference: https://answers.splunk.com/answers/337025/after-frozen-data-restore-thawed-data-not-working.html

• Question 25:

  At which default interval does metrics.log generate a periodic report regarding license utilization?

  A. 10 seconds
  B. 30 seconds
  C. 60 seconds
  D. 300 seconds
  B. 30 seconds

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Troubleshooting/Aboutmetricslog

• Question 26:

  A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

  A. The field was extracted as a private knowledge object.
  B. The events are tagged as communicate, but are missing the network tag.
  C. The Typing Queue, which does regular expression replacements, is blocked.
  D. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.
  D. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

  ---

  Reference: https://answers.splunk.com/answers/657187/map-command-field-not-being-evaluated.html

• Question 27:

  A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

  A. splunk add cluster-config
  B. splunk add cluster-master
  C. splunk edit cluster-config
  D. splunk edit cluster-master
  B. splunk add cluster-master

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Configuremulti-clustersearch

• Question 28:

  How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

  A. ITSI requires a dedicated deployment server.
  B. The amount of users using ITSI will not impact performance.
  C. ITSI in a Splunk deployment does not require additional hardware resources.
  D. Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.
  D. Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.

  ---

  Reference: https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan

• Question 29:

  Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

  A. Adding search peers increases the maximum size of search results.
  B. Adding RAM to an existing search heads provides additional search capacity.
  C. Adding search peers increases the search throughput as search load increases.
  D. Adding search heads provides additional CPU cores to run more concurrent searches.
  B. Adding RAM to an existing search heads provides additional search capacity.
  D. Adding search heads provides additional CPU cores to run more concurrent searches.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/HowsavedsearchesaffectSplunkEnterpriseperformance

• Question 30:

  Which of the following should be included in a deployment plan?

  A. Business continuity and disaster recovery plans.
  B. Current logging details and data source inventory.
  C. Current and future topology diagrams of the IT environment.
  D. A comprehensive list of stakeholders, either direct or indirect.
  D. A comprehensive list of stakeholders, either direct or indirect.

  ---

  Reference: https://docs.splunk.com/Documentation/CoE/ssf/Handbook/StakeholderReg