Splunk Splunk Certifications SPLK-2002 Questions & Answers

• Question 21:

  When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

  A. They will continue to replicate within the origin site and age out based on existing policies.

  B. They will maintain replication as required according to the single-site policies, but never age out.

  C. They will be replicated across all peers in the multi-site cluster and age out based on existing policies.

  D. They will stop replicating within the single-site and remain on the indexer they reside on and age out according to existing policies.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Migratetomultisite

• Question 22:

  When should multiple search pipelines be enabled?

  A. Only if disk IOPS is at 800 or better.

  B. Only if there are fewer than twelve concurrent users.

  C. Only if running Splunk Enterprise version 6.6 or later.

  D. Only if CPU and memory resources are significantly under-utilized.

  Correct Answer: D

  Reference: https://answers.splunk.com/answers/617608/can-we-increase-parallelingestionpipelines-in-ahe.html

• Question 23:

  Of the following types of files within an index bucket, which file type may consume the most disk?

  A. Rawdata

  B. Bloom filter

  C. Metadata (.data)

  D. Inverted index (.tsidx)

  Correct Answer: B

• Question 24:

  When troubleshooting monitor inputs, which command checks the status of the tailed files?

  A. splunk cmd btool inputs list | tail

  B. splunk cmd btool check inputs layer

  C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus

  D. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/ Troubleshoottheinputprocess#Troubleshoot_your_tailed_files

• Question 25:

  Which of the following is a best practice to maximize indexing performance?

  A. Use automatic sourcetyping.

  B. Use the Splunk default settings.

  C. Not use pre-trained source types.

  D. Minimize configuration generality.

  Correct Answer: D

• Question 26:

  A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

  A. splunk add cluster-config

  B. splunk add cluster-master

  C. splunk edit cluster-config

  D. splunk edit cluster-master

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Configuremulti-clustersearch

• Question 27:

  To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

  A. Indexers

  B. Forwarders

  C. Search head

  D. Cluster master

  Correct Answer: AB

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Pipelinesets

• Question 28:

  When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

  A. 1. Delete Splunk Enterprise, if it exists.

  2.

  Install and initialize the instance.

  3.

  Join the SHC.

  B. 1. Install and initialize the instance.

  2.

  Delete Splunk Enterprise, if it exists.

  3.

  Join the SHC.

  C. 1. Initialize cluster rebalance operation.

  2.

  Remove master node from cluster.

  3.

  Trigger replication.

  D. 1. Trigger replication.

  2.

  Remove master node from cluster.

  3.

  Initialize cluster rebalance operation.

  Correct Answer: B

• Question 29:

  Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

  A. telnet

  B. tcpdump

  C. splunk btool

  D. splunk btprobe

  Correct Answer: BC

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Security/ Troubleshootyouforwardertoindexerauthentication

• Question 30:

  What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

  A. Disables search site affinity.

  B. Sets all members to dynamic captaincy.

  C. Enables multisite search artifact replication.

  D. Enables automatic search site affinity discovery.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/DeploymultisiteSHC