Which of the following are possible causes of a crash in Splunk? (select all that apply)

Question

Options

• AIncorrect ulimit settings.
• BInsufficient disk IOPS.
• CInsufficient memory.
• DRunning out of disk space.

Explanation

All four options (A, B, C, D) are correct - each represents a documented cause of Splunk crashes or service failures.

Why all four apply:

• A (ulimit settings): Splunk requires sufficient file descriptor and process limits. If ulimit values (especially open files) are too low, Splunk cannot open the handles it needs and will crash or fail to start. Splunk's documentation explicitly lists minimum ulimit requirements.

• B (insufficient disk IOPS): Low disk throughput causes write queues to back up. When Splunk cannot flush its journal/index buckets fast enough, it can stall and crash, especially under high ingestion loads.

• C (insufficient memory): Splunk is memory-intensive. An OOM (out-of-memory) condition causes the OS to kill the Splunk process, resulting in a crash - this is one of the most common root causes in under-provisioned environments.

• D (running out of disk space): When disk space is exhausted, Splunk cannot write indexes or temp files and will crash immediately. This is arguably the most common real-world crash cause.

Memory tip: Think "DIMS" - Disk space, IOPS, Memory, Settings (ulimit). If any of these four infrastructure pillars are starved, Splunk goes down. On exams, whenever you see "select all that apply" for Splunk stability, resource starvation in any form is almost always a valid answer.

No community discussion yet for this question.