SPLK-2002 Practice Test

SPLK-2002 Practice Test practice questions, page 7 of 7, with answer review and explanations.

Question 31

Which of the following can a Splunk diag contain?

  1. Search history, Splunk users and their roles, running processes, indexed data
  2. Server specs, current open connections, internal Splunk log files, index listings
  3. KV store listings, internal Splunk log files, search peer bundles listings, indexed data
  4. Splunk platform configuration details, Splunk users and their roles, current open connections, index listings

Question 32

Which of the following are true statements about Splunk indexer clustering?

  1. All peer nodes must run exactly the same Splunk version.
  2. The master node must run the same or a later Splunk version than search heads.
  3. The peer nodes must run the same or a later Splunk version than the master node.
  4. The search head must run the same or a later Splunk version than the peer nodes.

Question 33

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

  1. Two indexers not in a cluster, assuming users run many long searches.
  2. Three indexers not in a cluster, assuming a long data retention period.
  3. Two indexers clustered, assuming high availability is the greatest priority.
  4. Two indexers clustered, assuming a high volume of saved/scheduled searches.

Question 34

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

  1. adhoc_searchhead = true (on all members)
  2. adhoc_searchhead = true (on the current captain)
  3. captain_is_adhoc_searchhead = true (on all members)
  4. captain_is_adhoc_searchhead = true (on the current captain)