SPLK-2002 Practice Test

SPLK-2002 Practice Test practice questions, page 5 of 7, with answer review and explanations.

Question 21

The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

  1. rawdata is: 10%, tsidx is: 40%
  2. rawdata is: 15%, tsidx is: 35%
  3. rawdata is: 35%, tsidx is: 15%
  4. rawdata is: 40%, tsidx is: 10%

Question 22

A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

  1. Create a job server on the cluster.
  2. Add another search head to the cluster.
  3. server.conf captain_is_adhoc_searchhead = true.
  4. Change limits.conf value for max_searches_per_cpu to a higher value.

Question 23

The frequency in which a deployment client contacts the deployment server is controlled by what?

  1. polling_interval attribute in outputs.conf
  2. phoneHomeIntervalInSecs attribute in outputs.conf
  3. polling_interval attribute in deploymentclient.conf
  4. phoneHomeIntervalInSecs attribute in deploymentclient.conf

Question 24

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

  1. repFactor = 0
  2. replicate = 0
  3. repFactor = auto
  4. replicate = auto

Question 25

Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

  1. Check serverclass.conf of the deployment server.
  2. Check deploymentclient.conf of the deployment client.
  3. Check the content of SPLUNK_HOME/etc/apps of the deployment server.
  4. Search for relevant events in splunkd.log of the deployment server.