Which of the following is a problem that could be investigated using the Search Job Inspector?

Error messages are appearing underneath the search bar in Splunk Web.

Dashboard panels are showing 'Waiting for queued job to start' on page load.

Different users are seeing different extracted fields from the same search.

Events are not being sorted in reverse chronological order.

When troubleshooting a situation where some files within a directory are not being indexed, the ignored files are discovered to have long headers. What is the first thing that should be added to inputs.conf?

Increase the value of initCrcLength.

Decrease the value of initCrcLength.

Add a crcSalt=<string> attribute.

Increase the value of initCrcLength.

Add a crcSalt=<SOURCE> attribute.

In an indexer cluster, what tasks does the cluster manager perform? (select all that apply)

Generates and maintains the list of primary searchable buckets.

If Indexer Discovery is enabled, provides the list of available peer nodes to forwarders.

Distributes app bundles to peer nodes.

Generates and maintains the list of primary searchable buckets.

If Indexer Discovery is enabled, provides the list of available peer nodes to forwarders.

Ensures all peer nodes are always using the same version of Splunk.

Distributes app bundles to peer nodes.

Determining data capacity for an index is a non-trivial exercise. Which of the following are possible considerations that would affect daily indexing volume? (select all that apply)

Number of concurrent searches on data.

Users are asking the Splunk administrator to thaw recently-frozen buckets very frequently. What could the Splunk administrator do to reduce the need to thaw buckets?

Change f rozenTimePeriodlnSecs to a larger value.

Change maxTotalDataSizeMB to a smaller value.

Change maxHotSpanSecs to a larger value.

Change coldToFrozenDir to a different location.

When should a dedicated deployment server be used?

When there are more than 50 deployment clients.

When there are more than 50 search peers.

When there are more than 50 apps to deploy to deployment clients.

When there are more than 50 deployment clients.

When there are more than 50 server classes.

What information is needed about the current environment before deploying Splunk? (select all that apply)

Overall goals for the deployment.

List of vendors for network devices.

Overall goals for the deployment.

Which of the following options in limits, conf may provide performance benefits at the forwarding tier?

Increase the parallellngestionPipelines attribute.

Enable the indexed_realtime_use_by_default attribute.

Increase the maxKBps attribute.

Increase the parallellngestionPipelines attribute.

Increase the max_searches per_cpu attribute.

Which of the following is a valid use case that a search head cluster addresses?

Provide redundancy in the event a search peer fails.

When using ingest-based licensing, what Splunk role requires the license manager to scale?

There are no roles that require the license manager to scale

A customer is migrating 500 Universal Forwarders from an old deployment server to a new deployment server, with a different DNS name. The new deployment server is configured and running.The old deployment server deployed an app containing an updated deploymentclient.conf file to all forwarders, pointing them to the new deployment server. The app was successfully deployed to all 500 forwarders.Why would all of the forwarders still be phoning home to the old deployment server?

The forwarders are configured to use the old deployment server in $SPLUNK_HOME/etc/system/local.

There is a version mismatch between the forwarders and the new deployment server.

The new deployment server is not accepting connections from the forwarders.

The forwarders are configured to use the old deployment server in $SPLUNK_HOME/etc/system/local.

The pass4SymmKey is the same on the new deployment server and the forwarders.

What types of files exist in a bucket within a clustered index? (select all that apply)

Inside a searchable bucket, there is tsidx and rawdata.

Inside a replicated bucket, there is both tsidx and rawdata.

Inside a replicated bucket, there is only rawdata.

Inside a searchable bucket, there is only tsidx.

Inside a searchable bucket, there is tsidx and rawdata.

Inside a replicated bucket, there is both tsidx and rawdata.

When designing the number and size of indexes, which of the following considerations should be applied?

Expected daily ingest volumes, data retention time policies, access controls

Expected daily ingest volume, access controls, number of concurrent users

Number of installed apps, expected daily ingest volume, data retention time policies

Data retention time policies, number of installed apps, access controls

Expected daily ingest volumes, data retention time policies, access controls

When implementing KV Store Collections in a search head cluster, which of the following considerations is true?

The search head cluster captain is also the KV Store Primary when collection content changes.

The KV Store Primary coordinates with the search head cluster captain when collection content changes.

The search head cluster captain is also the KV Store Primary when collection content changes.

The KV Store Collection will not allow for changes to content if there are more than 50 search heads in the cluster.

Each search head in the cluster independently updates its KV store collection when collection content changes.

Which of the following is true for indexer cluster knowledge bundles?

app-name/default and app-name/local are merged before pushing.

Only app-name/default is pushed.

app-name/default and app-name/local are pushed without change.

Where in the Job Inspector can details be found to help determine where performance is affected?

Search Job Properties > runDuration

Search Job Properties > runtime

Job Details Dashboard > Total Events Matched

What is the best method for sizing or scaling a search head cluster?

Estimate the maximum concurrent number of searches and divide by the number of CPU cores per search head.

Estimate the maximum daily ingest volume in gigabytes and divide by the number of CPU cores per search head.

Estimate the total number of searches per day and divide by the number of CPU cores available on the search heads.

Divide the number of indexers by three to achieve the correct number of search heads.

Estimate the maximum concurrent number of searches and divide by the number of CPU cores per search head.

An index has large text log entries with many unique terms in the raw data. Other than the raw data, which index components will take the most space?

Bloom filters (bloomfilter files).

Index source metadata (sources.data files).

Index sourcetype metadata (SourceTypes. data files).

A search head cluster with a KV store collection can be updated from where in the KV store collection?

Any search head in the cluster.

The search head cluster captain.

The KV store primary search head.

Any search head except the captain.

Any search head in the cluster.

If there is a deployment server with many clients and one deployment client is not updating apps, which of the following should be done first?

Choose a corrective action based on the splunkd. log of the deployment client.

Choose a longer phone home interval for all of the deployment clients.

Increase the number of CPU cores for the deployment server.

Choose a corrective action based on the splunkd. log of the deployment client.

Increase the amount of memory for the deployment server.

To expand the search head cluster by adding a new member, node2, what first step is required?

splunk init shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

splunk bootstrap shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

splunk init shcluster-config -master_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

splunk init shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

splunk add shcluster-member -new_member_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

When should a Universal Forwarder be used instead of a Heavy Forwarder?

When there is a high-velocity data source.

When most of the data requires masking.

When there is a high-velocity data source.

When data comes directly from a database server.

When a modular input is needed.

Splunk SPLK-2002 Practice Test 4 - Free Online Exam Prep & Questions

A monitored log file is changing on the forwarder. However, Splunk searches are not finding any new data that has been added. What are possible causes? (select all that apply)

Become a Premium Member for full access

Unlock Premium Member

Splunk SPLK-2002 Practice Test 4

Question

Splunk SPLK-2002 Practice Tests

Practice Tests