Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 41:

  When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

  A. Auto
  B. None
  C. True
  D. False
  C. True

  ---

  Reference: https://answers.splunk.com/answers/6926/how-to-keep-data-together-as-one-event.html

• Question 42:

  Which search will show all deployment client messages from the client (UF)?

  A. index=_audit component=DC* host= | stats count by message
  B. index=_audit component=DC* host= | stats count by message
  C. index=_internal component= DC* host= | stats count by message
  D. index=_internal component=DS* host= | stats count by message
  D. index=_internal component=DS* host= | stats count by message

  ---

  Reference: https://answers.splunk.com/answers/461939/after-all-clients-are-registered-to-a-deployment-s.html

• Question 43:

  A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:

  [clustering] mode = master replication_factor = 2 pass4SymmKey = password123

  Which of the following statements describe this Splunk instance? (Select all that apply.)

  A. This is a multi-site cluster.
  B. This cluster's search factor is 2.
  C. This Splunk instance needs to be restarted.
  D. This instance is missing the master_uri attribute.
  A. This is a multi-site cluster.
  C. This Splunk instance needs to be restarted.

• Question 44:

  What is the minimum reference server specification for a Splunk indexer?

  A. 12 CPU cores, 12GB RAM, 800 IOPS
  B. 16 CPU cores, 16GB RAM, 800 IOPS
  C. 24 CPU cores, 16GB RAM, 1200 IOPS
  D. 28 CPU cores, 32GB RAM, 1200 IOPS
  A. 12 CPU cores, 12GB RAM, 800 IOPS

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/Referencehardware#Reference_host_specification

• Question 45:

  When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

  A. They will continue to replicate within the origin site and age out based on existing policies.
  B. They will maintain replication as required according to the single-site policies, but never age out.
  C. They will be replicated across all peers in the multi-site cluster and age out based on existing policies.
  D. They will stop replicating within the single-site and remain on the indexer they reside on and age out according to existing policies.
  B. They will maintain replication as required according to the single-site policies, but never age out.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Migratetomultisite

• Question 46:

  What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

  A. Disables search site affinity.
  B. Sets all members to dynamic captaincy.
  C. Enables multisite search artifact replication.
  D. Enables automatic search site affinity discovery.
  A. Disables search site affinity.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/DeploymultisiteSHC

• Question 47:

  To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

  A. repFactor = 0
  B. replicate = 0
  C. repFactor = auto
  D. replicate = auto
  C. repFactor = auto

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Configurethepeerindexes

• Question 48:

  Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

  A. Is the job scheduler for the entire SHC.
  B. Manages alert action suppressions (throttling).
  C. Synchronizes the member list with the KV store primary.
  D. Replicates the SHC's knowledge bundle to the search peers.
  A. Is the job scheduler for the entire SHC.
  D. Replicates the SHC's knowledge bundle to the search peers.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture#role_of_the_captain

• Question 49:

  Which two sections can be expanded using the Search Job Inspector?

  A. Execution costs.
  B. Saved search history.
  C. Search job properties.
  D. Optimization suggestions.
  B. Saved search history.
  C. Search job properties.

• Question 50:

  Which of the following statements describe search head clustering? (Select all that apply.)

  A. A deployer is required.
  B. At least three search heads are needed.
  C. Search heads must meet the high-performance reference server requirements.
  D. The deployer must have sufficient CPU and network resources to process service requests and push configurations.
  A. A deployer is required.
  C. Search heads must meet the high-performance reference server requirements.