SPLK-2002(205Q) Exam Questions

Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search perfor...

A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web source. Further inves...

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer in...

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

Which of the following should be included in a deployment plan?

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

Which of the following are client filters available in serverclass.conf? (Select all that apply.)

What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk deployment?

In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

Which of the following is true regarding Splunk Enterprise's performance? (Select all that apply.)

Which Splunk Enterprise offering has its own license?

Which component in the splunkd.log will log information related to bad event breaking?

Which Splunk server role regulates the functioning of indexer cluster?

When adding or rejoining a member to a search head cluster, the following error is displayed: Error pulling configurations from the search head cluster captain; consider performing...

Which of the following commands is used to clear the KV store?

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Wh...

The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used...

A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

The frequency in which a deployment client contacts the deployment server is controlled by what?

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

What is the minimum reference server specification for a Splunk indexer?

Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)

Which command will permanently decommission a peer node operating in an indexer cluster?

Which CLI command converts a Splunk instance to a license slave?

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this i...

Which of the following can a Splunk diag contain?

Which of the following are true statements about Splunk indexer clustering?

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The custo...

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

At which default interval does metrics.log generate a periodic report regarding license utilization?

Which of the following is a good practice for a search head cluster deployer?

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

Which Splunk internal index contains license-related events?

Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

Which search will show all deployment client messages from the client (UF)?

To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling j...

Configurations from the deployer are merged into which location on the search head cluster member?

When Splunk indexes data in a non-clustered environment, what kind of files does it create by default?

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

In the deployment planning process, when should a person identify who gets to see network data?

The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?