SPLK-2002 Practice Test

SPLK-2002 Practice Test practice questions, page 2 of 7, with answer review and explanations.

Question 6

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

  1. Distributes apps to SHC members.
  2. Bootstraps a clean Splunk install for a SHC.
  3. Distributes non-search related and manual configuration file changes.
  4. Distributes runtime knowledge object changes made by users across the SHC.

Question 7

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

  1. Auto
  2. None
  3. True
  4. False

Question 8

Which of the following should be included in a deployment plan?

  1. Business continuity and disaster recovery plans.
  2. Current logging details and data source inventory.
  3. Current and future topology diagrams of the IT environment.
  4. A comprehensive list of stakeholders, either direct or indirect.

Question 9

A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

  1. Via Splunk Web.
  2. Directly edit SPLUNK_HOME/etc/system/local/server.conf
  3. Run a splunk edit cluster-config command from the CLI.
  4. Directly edit SPLUNK_HOME/etc/system/default/server.conf

Question 10

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

  1. REPORT
  2. LINE_BREAKER
  3. ANNOTATE_PUNCT
  4. SHOULD_LINEMERGE