SPLK-2002 Practice Test

SPLK-2002 Practice Test practice questions, page 4 of 7, with answer review and explanations.

Question 16

Which component in the splunkd.log will log information related to bad event breaking?

  1. Audittrail
  2. EventBreaking
  3. IndexingPipeline
  4. AggregatorMiningProcessor

Question 17

Which Splunk server role regulates the functioning of indexer cluster?

  1. Indexer
  2. Deployer
  3. Master Node
  4. Monitoring Console

Question 18

When adding or rejoining a member to a search head cluster, the following error is displayed: Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member. What corrective action should be taken?

  1. Restart the search head.
  2. Run the splunk apply shcluster-bundle command from the deployer.
  3. Run the clean raft command on all members of the search head cluster.
  4. Run the splunk resync shcluster-replicated-config command on this member.

Question 19

Which of the following commands is used to clear the KV store?

  1. splunk clean kvstore
  2. splunk clear kvstore
  3. splunk delete kvstore
  4. splunk reinitialize kvstore

Question 20

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

  1. Increase the maximum number of hot buckets in indexes.conf
  2. Increase the number of parallel ingestion pipelines in server.conf
  3. Decrease the maximum size of the search pipelines in limits.conf
  4. Decrease the maximum concurrent scheduled searches in limits.conf