10 free Splunk SPLK-2002 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 172 questions. Work through them, then open each answer to check your reasoning.
Get all 172 questions (US$39) · Download these 10 as a PDF
Question 1
Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?
Show answer and explanation
Correct answer: C. Decreasing the data model acceleration range.
In an Enterprise Security deployment the data model acceleration summaries are the dominant disk consumer, frequently approaching or exceeding the size of the indexed data itself. Reducing the acceleration range (the summariesonly time span ES accelerates) deletes or prevents the largest volume of tsidx summary files across every indexer, so it produces the greatest single reduction in storage. Replication and search factor settings change how many copies exist, but in a cluster they are set to fixed values such as 3 by default and are not tied to the indexer count N, so they offer no comparable guaranteed savings.
Why the other options are wrong
- A. The search factor is normally far lower than the indexer count, so setting it to N-1 in a cluster of N indexers would add searchable copies and increase disk usage rather than reduce it.
- B. Increasing the number of buckets simply redistributes the same volume of data into smaller units and can add overhead.
- D. The replication factor is independent of the number of indexers and defaults to a small number, so raising it to N-1 would multiply the copies of raw data and grow the footprint.
Question 2
Stakeholders have identified high availability for searchable data as their top priority.
Which of the following best addresses this requirement?
Show answer and explanation
Correct answer: A. Increasing the search factor in the cluster.
The search factor defines how many searchable copies of each bucket the indexer cluster maintains, and a searchable copy includes the tsidx and metadata files needed to return results. Raising the search factor means that when an indexer goes down, another peer already holds a searchable copy and the cluster keeps serving complete results without waiting for a rebuild. That is exactly what high availability of searchable data means.
Why the other options are wrong
- B. The replication factor governs how many total copies of raw data survive a peer failure, and non-searchable copies must first be converted into searchable ones before results are complete.
- C. Adding search heads protects the search tier and user access, not the availability of the indexed data being searched.
- D. More CPU on the indexers increases search and indexing throughput but provides no redundancy if a peer fails.
Question 3
Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity.
Which of the following options will provide the most search performance improvement?
Show answer and explanation
Correct answer: D. Add more search peers and make sure forwarders distribute data evenly across all indexers.
When a distributed deployment approaches capacity, adding more indexers (search peers) and ensuring even data distribution provides the most immediate and substantial search performance improvement. This increases the total indexable and searchable data capacity while distributing load. SSD upgrades help but are expensive with diminishing returns. Rescheduling slow searches addresses specific issues but doesn't solve overall capacity problems. Adding search heads without indexers doesn't improve search performance since the bottleneck is data processing, not search head resources.
Why the other options are wrong
- A. Storage upgrades provide benefits but are less efficient than horizontal scaling of indexing capacity.
- B. Search heads distribute searches but don't increase the data processing capacity when indexers are the bottleneck.
- C. Rescheduling addresses specific slow searches but doesn't resolve systemic capacity issues affecting overall performance.
Question 4
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.
Which of the following items might be the cause for this issue?
Show answer and explanation
Correct answer: C. The indexers may have different configurations than the heavy forwarders.
Event formatting is decided at parse time by props.conf settings such as LINE_BREAKER, SHOULD_LINEMERGE, TRUNCATE and timestamp attributes. A heavy forwarder parses and cooks events before shipping them, so it must carry the same props.conf as the indexers that parse the data arriving from universal forwarders. When those two sets of configurations diverge, identical web logs are broken and timestamped differently depending on the path they took, which is exactly the inconsistency described.
Why the other options are wrong
- A. Search head settings control search-time extraction and display, so they cannot change how events were already broken and written at index time.
- B. Input definitions control what is collected and which sourcetype and index are assigned, but the sourcetype here is already consistent, so the differing event boundaries point to parsing configuration instead.
- D. A version difference between forwarders can raise compatibility or feature concerns, but identical parsing configurations would still produce identically formatted events.
Question 5
A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master.
How much data can the customer ingest before search is locked out?
Show answer and explanation
Correct answer: D. Search is not locked out. Violations are still recorded.
A no-enforcement license does not lock out search when limits are exceeded; it only records violations for reporting purposes. When multiple licenses are installed on the same license master, they pool together, but the no-enforcement license specifically allows data ingestion to continue beyond its capacity threshold without triggering search lockout. This means the customer can ingest beyond both the 500GB enterprise license and the 300GB no-enforcement license without search lockout, though violations are logged.
Why the other options are wrong
- A. The 300GB limit is from a no-enforcement license, which does not trigger lockout.
- B. The 500GB limit would only apply if there were no no-enforcement license present.
- C. While licenses pool, the no-enforcement license prevents lockout even after the combined capacity is exceeded.
Question 6
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
Show answer and explanation
Correct answer: A, C
A. Distributes apps to SHC members. C. Distributes non-search related and manual configuration file changes. The deployer is the dedicated instance that pushes the configuration bundle from its shcluster/apps and shcluster/users directories out to every search head cluster member. That bundle carries both apps and the non-search-related or manually edited configuration files an administrator places there, keeping all members identical. Runtime knowledge objects created by users are handled separately by the cluster's own replication between members, and the deployer plays no part in standing up or bootstrapping a new install.
Why the other options are wrong
- B. Bootstrapping a search head cluster is done on the members themselves with the init and bootstrap captain commands, not by the deployer.
- D. Knowledge objects created by users at runtime are replicated member to member by the cluster replication mechanism, which never involves the deployer.
Question 7
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?
Show answer and explanation
Correct answer: D. False
SHOULD_LINEMERGE must be set to false when LINE_BREAKER defines the event boundaries. With false, Splunk uses the LINE_BREAKER regex alone to split the stream into events, which is both correct and faster. Leaving the line merge processor active would hand the data to the BREAK_ONLY_BEFORE style heuristics and produce unpredictable multi-line events.
Why the other options are wrong
- A. SHOULD_LINEMERGE is a boolean attribute, and auto is not an accepted value for it.
- B. None is not a valid value for this attribute either.
- C. True is the default and enables the line merge processor, which conflicts with and overrides the intent of an explicit LINE_BREAKER.
Question 8
Which of the following should be included in a deployment plan?
Show answer and explanation
Correct answer: C. Current and future topology diagrams of the IT environment.
A Splunk deployment plan documents the architecture being built, so it centers on diagrams of the IT environment as it exists today and as it will look after the deployment. Those current and future state topologies show component placement, data flow, network boundaries and the migration path, which is what implementers and reviewers work from. The other items belong to requirements gathering, project management or operational runbooks that sit outside the deployment plan itself.
Why the other options are wrong
- A. Business continuity and disaster recovery are handled in separate operational documents, even though the deployment must eventually support them.
- B. A logging and data source inventory is collected during requirements gathering and feeds the design, but it is not what the deployment plan itself sets out.
- D. A stakeholder list belongs to the project charter and communication plan rather than the technical deployment plan.
Question 9
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
Show answer and explanation
Correct answer: B, C
B. Directly edit SPLUNK_HOME/etc/system/local/server.conf C. Run a splunk edit cluster-config command from the CLI. Multisite indexer clustering is enabled either by editing the clustering stanzas in $SPLUNK_HOME/etc/system/local/server.conf or by running splunk edit cluster-config with the multisite and site parameters from the CLI. Both methods write the same settings, including multisite, site, and the site_replication_factor and site_search_factor values. Splunk Web exposes only basic single-site clustering settings, so it cannot be used to build a multisite cluster.
Why the other options are wrong
- A. Splunk Web's clustering pages do not provide the multisite, site and site replication or search factor settings required for a multisite cluster.
- D. Files under etc/system/default are shipped defaults that are overwritten on upgrade and must never be edited directly.
Question 10
Which index-time props.conf attributes impact indexing performance? (Select all that apply.)
Show answer and explanation
Correct answer: B, C, D
B. LINE_BREAKER C. ANNOTATE_PUNCT D. SHOULD_LINEMERGE LINE_BREAKER, SHOULD_LINEMERGE and ANNOTATE_PUNCT are all index-time props.conf attributes handled by the parsing and indexing pipelines. A costly LINE_BREAKER regex and an active line merge processor both add CPU work to every event, which is why setting SHOULD_LINEMERGE to false with a precise LINE_BREAKER is the recommended high volume configuration. ANNOTATE_PUNCT controls creation of the punct:: field for every event, and disabling it is a documented way to reduce indexing overhead.
Why the other options are wrong
- A. REPORT defines search-time field extractions, so it is evaluated when a search runs and has no effect on indexing throughput.
That was 10 of 172.
The full Splunk SPLK-2002 pack has all 172 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.