Splunk Splunk Certifications SPLK-2002 Questions & Answers

• Question 71:

  Which of the following commands is used to clear the KV store?

  A. splunk clean kvstore

  B. splunk clear kvstore

  C. splunk delete kvstore

  D. splunk reinitialize kvstore

  Correct Answer: A

  Reference: https://answers.splunk.com/answers/237859/can-i-delete-all-data-from-a-kv-store-at-once.html

• Question 72:

  When adding or rejoining a member to a search head cluster, the following error is displayed: Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.

  What corrective action should be taken?

  A. Restart the search head.

  B. Run the splunk apply shcluster-bundle command from the deployer.

  C. Run the clean raft command on all members of the search head cluster.

  D. Run the splunk resync shcluster-replicated-config command on this member.

  Correct Answer: B

• Question 73:

  Which Splunk Enterprise offering has its own license?

  A. Splunk Cloud Forwarder

  B. Splunk Heavy Forwarder

  C. Splunk Universal Forwarder

  D. Splunk Forwarder Management

  Correct Answer: C

  Reference: https://docs.splunk.com/Splexicon:Forwardinglicense

• Question 74:

  Which component in the splunkd.log will log information related to bad event breaking?

  A. Audittrail

  B. EventBreaking

  C. IndexingPipeline

  D. AggregatorMiningProcessor

  Correct Answer: D

  Reference: https://answers.splunk.com/answers/141721/error-in-splunkd-log-breaking-event-becauselimit-of-256-has-been-exceeded.html

• Question 75:

  Which Splunk server role regulates the functioning of indexer cluster?

  A. Indexer

  B. Deployer

  C. Master Node

  D. Monitoring Console

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Deploy/Indexercluster

• Question 76:

  Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

  A. Adding search peers increases the maximum size of search results.

  B. Adding RAM to an existing search heads provides additional search capacity.

  C. Adding search peers increases the search throughput as search load increases.

  D. Adding search heads provides additional CPU cores to run more concurrent searches.

  Correct Answer: BD

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/ HowsavedsearchesaffectSplunkEnterpriseperformance

• Question 77:

  What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

  A. btool.log

  B. metrics.log

  C. splunkd.log

  D. tailing_processor.log

  Correct Answer: C

  Reference: https://answers.splunk.com/answers/479312/how-to-edit-inputsconf-to-monitor-multiple-files-w

  1.html

• Question 78:

  Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk deployment?

  A. btool

  B. DiagGen

  C. SPL Clinic

  D. Monitoring Console

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/DMCoverview

• Question 79:

  In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

  A. site_search_factor = origin:2, site1:2, total:4

  B. site_search_factor = origin:2, site2:1, total:4

  C. site_replication_factor = origin:2, site1:2, total:4

  D. site_replication_factor = origin:2, site2:1, total:4

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Sitereplicationfactor

• Question 80:

  Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

  A. REPORT

  B. LINE_BREAKER

  C. ANNOTATE_PUNCT

  D. SHOULD_LINEMERGE

  Correct Answer: BD

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Data/Configureeventlinebreaking