VCEdump

SPLK-2002 Splunk Enterprise Certified Architect

PDF question preview Back to product

Reading controls

Reader tools

Free demo

14 of 90 questions

Purchase the full version to unlock every question and answer.

View the full question set

Preview tools

Try Web TestEngine

Question formats

Single choice11

Multiple choice3

Splunk · SPLK-2002

Free SPLK-2002 Exam Dumps Preview

Preview real exam questions, verified answers and available explanations before choosing a study plan.

Question 1

Single choice

At which default interval does metrics.log generate a periodic report regarding license utilization?

A
10 seconds
B
30 seconds
C
60 seconds
D
300 seconds

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Troubleshooting/Aboutmetricslog

Question 2

Single choice

When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

A
replication_factor = 2
search_factor = 2
B
replication_factor = 2
search factor = 3
C
replication_factor = 3
search_factor = 2
D
replication_factor = 3
search factor = 3

Reveal answer details Close answer details

Correct answerC

Question 3

Single choice

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

A
Auto
B
None
C
True
D
False

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://answers.splunk.com/answers/6926/how-to-keep-data-together-as-one-event.html

Question 4

Single choice

What is the logical first step when starting a deployment plan?

A
Inventory the currently deployed logging infrastructure.
B
Determine what apps and use cases will be implemented.
C
Gather statistics on the expected adoption of Splunk for sizing.
D
Collect the initial requirements for the deployment from all stakeholders.

Reveal answer details Close answer details

Correct answerD

Question 5

Single choice

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk.

How many indexers are recommended for this deployment?

A
Two indexers not in a cluster, assuming users run many long searches.
B
Three indexers not in a cluster, assuming a long data retention period.
C
Two indexers clustered, assuming high availability is the greatest priority.
D
Two indexers clustered, assuming a high volume of saved/scheduled searches.

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/
Summaryofperformancerecommendations

Question 6

Single choice

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

A
1. Delete Splunk Enterprise, if it exists.
2. Install and initialize the instance.
3. Join the SHC.
B
1. Install and initialize the instance.
2. Delete Splunk Enterprise, if it exists.
3. Join the SHC.
C
1. Initialize cluster rebalance operation.
2. Remove master node from cluster.
3. Trigger replication.
D
1. Trigger replication.
2. Remove master node from cluster.
3. Initialize cluster rebalance operation.

Reveal answer details Close answer details

Correct answerB

Question 7

Single choice

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity.

Which of the following options will provide the most search performance improvement?

A
Replace the indexer storage to solid state drives (SSD).
B
Add more search heads and redistribute users based on the search type.
C
Look for slow searches and reschedule them to run during an off-peak time.
D
Add more search peers and make sure forwarders distribute data evenly across all indexers.

Reveal answer details Close answer details

Correct answerC

Question 8

Multiple choice

A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

A
Via Splunk Web.
B
Directly edit SPLUNK_HOME/etc/system/local/server.conf
C
Run a splunk edit cluster-config command from the CLI.
D
Directly edit SPLUNK_HOME/etc/system/default/server.conf

Reveal answer details Close answer details

Correct answersA, B

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Enableclustersindetail

Question 9

Single choice

When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

A
They will continue to replicate within the origin site and age out based on existing policies.
B
They will maintain replication as required according to the single-site policies, but never age out.
C
They will be replicated across all peers in the multi-site cluster and age out based on existing policies.
D
They will stop replicating within the single-site and remain on the indexer they reside on and age out according to existing policies.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Migratetomultisite

Question 10

Multiple choice

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

A
Adding search peers increases the maximum size of search results.
B
Adding RAM to an existing search heads provides additional search capacity.
C
Adding search peers increases the search throughput as search load increases.
D
Adding search heads provides additional CPU cores to run more concurrent searches.

Reveal answer details Close answer details

Correct answersB, D

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/
HowsavedsearchesaffectSplunkEnterpriseperformance

Question 11

Single choice

How does the average run time of all searches relate to the available CPU cores on the indexers?

A
Average run time is independent of the number of CPU cores on the indexers.
B
Average run time decreases as the number of CPU cores on the indexers decreases.
C
Average run time increases as the number of CPU cores on the indexers decreases.
D
Average run time increases as the number of CPU cores on the indexers increases.

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/
Accommodatemanysimultaneoussearches

Question 12

Single choice

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip.
Which of the following may explain the problem?
(Select all that apply.)

A
The field was extracted as a private knowledge object.
B
The events are tagged as communicate, but are missing the network tag.
C
The Typing Queue, which does regular expression replacements, is blocked.
D
The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://answers.splunk.com/answers/657187/map-command-field-not-being-evaluated.html

Question 13

Single choice

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps.

Which of the following directories has the highest precedence?

A
System local directory.
B
System default directory.
C
App local directories, in ASCII order.
D
App default directories, in ASCII order.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Wheretofindtheconfigurationfiles

Question 14

Multiple choice

In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)

A
Use the Monitoring Console.
B
Use the Search Head Clustering settings menu from Splunk Web on any member.
C
Run the splunk transfer shcluster-captain command from the current captain.
D
Run the splunk transfer shcluster-captain command from the member you would like to become the captain.

Reveal answer details Close answer details

Correct answersB, D

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Transfercaptain

Free SPLK-2002 Exam Dumps Preview

Splunk Enterprise Certified Architect

PREVIEW CONTENTS · 2 VOLUMES

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5

QUESTION 6

QUESTION 7

QUESTION 8

QUESTION 9

QUESTION 10

QUESTION 11

QUESTION 12

QUESTION 13

QUESTION 14

VOL	TYPE	QUESTIONS
1	Single choice	11
2	Multiple choice	3