43 free Splunk SPLK-2002 practice questions from the CertStash pack of 172, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 43 free here, all 172 in the pack, and each step includes the one before it.
Get all 172 questions (US$39) · Download the first 10 as a PDF
Question 1
Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)
Show answer and explanation
Correct answer: A, B, D. Check serverclass.conf of the deployment server; Check deploymentclient.conf of the deployment client; Search for relevant events in splunkd.log of the deployment server.
When apps are not appearing on a deployment client, you should verify the deployment server's serverclass.conf to ensure the client is targeted correctly (A), check the deployment client's deploymentclient.conf to confirm it's configured to connect to the correct server (B), and search splunkd.log on the deployment server for errors during app deployment attempts (D). While checking the apps directory on the deployment server (C) can be useful, it's not a primary troubleshooting step since the configuration issues are typically the root cause.
Why the other options are wrong
- C. Checking the apps directory contents is less critical than verifying the actual deployment configuration files and server logs.
Question 2
Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?
Show answer and explanation
Correct answer: B. Certificate authentication between forwarders and indexers.
Certificate authentication between forwarders and indexers must be explicitly configured and is not enabled by default. Data encryption between Splunk Web and splunkd (A) is enabled by default. Certificate authentication between Splunk Web and search head (C) is enabled by default. Data encryption for distributed search between search heads and indexers (D) is enabled by default. Only certificate-based mutual authentication requires explicit configuration.
Why the other options are wrong
- A. Splunk Web to splunkd encryption is enabled by default.
- C. Splunk Web to search head certificate authentication is enabled by default.
- D. Distributed search data encryption is enabled by default.
Question 3
Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)
Show answer and explanation
Correct answer: B, D. Internal logs; Configuration files.
A Splunk diag file includes internal logs (B) such as splunkd.log and metrics.log, and configuration files (D) from the etc directory. It explicitly excludes customer data (C) for privacy and security reasons, and does not capture live OS settings (A), though it may include some system information captured at the time of diag creation.
Why the other options are wrong
- A. OS settings are not included in a diag file.
- C. Customer data and indexed data are explicitly excluded from diag files for security and privacy.
Question 4
Which command will permanently decommission a peer node operating in an indexer cluster?
Show answer and explanation
Correct answer: C. splunk offline --enforce-counts
The command splunk offline --enforce-counts permanently decommissions a peer node in an indexer cluster. This command ensures that all data is properly copied to other cluster members before the peer goes offline. The --enforce-counts flag verifies that replica counts are met before completing the decommission process.
Why the other options are wrong
- A. splunk stop -f only stops the Splunk service; it does not decommission the peer.
- B. splunk offline -f takes a peer offline but does not permanently decommission it.
- D. This command syntax is incorrect; the proper syntax uses --enforce-counts with two hyphens.
Question 5
Which CLI command converts a Splunk instance to a license slave?
Show answer and explanation
Correct answer: C. splunk edit licenser-localslave
The command splunk edit licenser-localslave converts a Splunk instance to a license slave by configuring it to connect to a license master. This command modifies the local license configuration to point to an external license master instead of using a local license.
Why the other options are wrong
- A. splunk add licenses is used to add license files to a license master, not to configure a slave.
- B. splunk list licenser-slaves lists existing license slaves; it does not create or configure one.
- D. splunk list licenser-localslave lists the local slave configuration but does not edit or create it.
Question 6
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)
Show answer and explanation
Correct answer: C, D. disk_objects.log; resource_usage.log
The _introspection index contains platform instrumentation data logged by Splunk Enterprise, including disk_objects.log (C) which tracks disk usage and objects, and resource_usage.log (D) which records resource consumption metrics. The audit.log (A) is stored in the _audit index, and metrics.log (B) is stored in the _internal index, not _introspection.
Why the other options are wrong
- A. audit.log is stored in the _audit index, not _introspection.
- B. metrics.log is stored in the _internal index, not _introspection.
Question 7
Which of the following can a Splunk diag contain?
Show answer and explanation
Correct answer: B. Server specs, current open connections, internal Splunk log files, index listings
A Splunk diag file contains server specifications, current open connections, internal Splunk log files, and index listings. These are system and diagnostic artifacts that help troubleshoot Splunk deployment issues. Option A is incorrect because it includes indexed data, which diags do not contain. Option C is incorrect because it includes indexed data. Option D is incorrect because while it includes configuration details, users, roles, and connections, diags do not include indexed data, making B the most complete and accurate answer.
Why the other options are wrong
- A. Diags do not contain indexed data or search history.
- C. Diags do not contain indexed data.
- D. While diags contain configuration and users/roles, they do not include indexed data.
Question 8
Which of the following are true statements about Splunk indexer clustering?
Show answer and explanation
Correct answer: A. All peer nodes must run exactly the same Splunk version.
All peer nodes in an indexer cluster must run exactly the same Splunk version to ensure consistency in clustering operations and prevent data replication issues. This is a strict requirement for cluster stability. The master node and search heads have more flexible version requirements relative to peer nodes, but peer nodes must be identical to each other.
Why the other options are wrong
- B. While the master should typically be at the same level or higher, this is not a strict requirement like peer node version matching.
- C. Peer nodes can run the same or later version than the master, not the other way around.
- D. Search heads do not have strict version requirements relative to peer nodes in a cluster.
Question 9
Which Splunk server role regulates the functioning of indexer cluster?
Show answer and explanation
Correct answer: C. Master Node
The Master Node (also called Cluster Master) is the server role responsible for regulating and managing the functioning of an indexer cluster. It maintains the cluster state, manages peer indexers, handles bucket replication, and ensures data consistency across the cluster.
Why the other options are wrong
- A. Indexers are peer nodes that store and index data but do not regulate cluster functioning.
- B. The Deployer distributes configurations to search head clusters and indexer clusters but does not regulate indexer cluster operations.
- D. The Monitoring Console provides visibility into Splunk environments but does not regulate cluster functioning.
Question 10
When adding or rejoining a member to a search head cluster, the following error is displayed: Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member. What corrective action should be taken?
Show answer and explanation
Correct answer: D. Run the splunk resync shcluster-replicated-config command on this member.
When a search head cluster member encounters configuration synchronization errors from the captain, running the splunk resync shcluster-replicated-config command on the affected member forces it to resynchronize replicated configurations from the captain, resolving the configuration pull error.
Why the other options are wrong
- A. Simply restarting the search head may not resolve underlying configuration synchronization issues.
- B. The apply shcluster-bundle command is used by the deployer to push bundles but does not directly resync a member's configuration from the captain.
- C. The clean raft command is used to reset Raft consensus state but is not the appropriate remediation for configuration pull errors.
What people say about the full SPLK-2002 pack 4.7 from 7
Cert Stash’s SPLK-2002 questions were easy to follow and very close to the actual exam. I passed smoothly.
Passed the SPLK-2002 exam yesterday. Valid SPLK-2002 real exam questions. Thanks!
yup, braindump for SPLK-2002 exam is actual and updated. all the questions comprised in it are within the exam context. for sure, you’ll organize the learned information and learn something new from it. good luck!
Question 11
When troubleshooting monitor inputs, which command checks the status of the tailed files?
Show answer and explanation
Correct answer: C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus
The REST endpoint curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus provides detailed status information about monitored files, including which files are being tailed, their current position, and any tailing errors. This is the standard method for checking the status of tailed files in Splunk.
Why the other options are wrong
- A. btool is a configuration validation tool, not an input status monitoring tool.
- B. btool does not have a 'check inputs layer' command for monitoring file status.
- D. While this endpoint is similar, :Tailstatus is not the correct endpoint name for file status information.
Question 12
When planning a search head cluster, which of the following is true?
Show answer and explanation
Correct answer: A. All search heads must use the same operating system.
All search heads in a cluster must use the same operating system to ensure compatibility and consistent behavior across the cluster members. This is a fundamental requirement for cluster stability and support.
Why the other options are wrong
- B. Standalone search heads can exist alongside search head clusters in a deployment; not all search heads must be cluster members.
- C. The captain is elected dynamically based on cluster logic and heartbeat mechanisms, not assigned to the largest member.
- D. Standalone indexers can exist in a deployment; not all indexers must belong to an indexer cluster.
Question 13
How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?
Show answer and explanation
Correct answer: D. Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.
ITSI (IT Service Intelligence) is a resource-intensive application that requires careful capacity planning. The specific KPIs being tracked, the number of entities monitored, and the data volumes involved all determine whether additional hardware resources are needed to support ITSI alongside the base Splunk deployment.
Why the other options are wrong
- A. ITSI does not require a dedicated deployment server; it is a Splunk app that runs on search heads
- B. ITSI performance impact is significant and scales with user load and data complexity
- C. ITSI requires additional resources including more CPU, memory, and storage depending on implementation scope
Question 14
Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?
Show answer and explanation
Correct answer: D. Setting the cluster replication factor to N-1.
Setting the cluster replication factor to N-1 means each bucket is replicated to N-1 indexers instead of N indexers, directly reducing the total disk storage needed across the cluster. While search factor affects searchability and bucket count affects performance, the replication factor directly controls how many copies of data are stored, making it the primary lever for reducing total disk consumption.
Why the other options are wrong
- A. Search factor determines how many copies must be searchable but doesn't reduce the total number of copies stored.
- B. More buckets increases disk requirements, not decreases them.
- C. Data model acceleration range affects acceleration storage but not the main indexed data disk requirements.
Question 15
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?
Show answer and explanation
Correct answer: C. splunkd.log
The splunkd.log file contains comprehensive logging for all Splunk daemon activities including input processing and monitor stanza interpretation. Regular expression parsing errors in monitor stanzas are logged to splunkd.log where administrators can diagnose configuration issues. Btool.log, metrics.log, and tailing_processor.log do not contain regex interpretation errors.
Why the other options are wrong
- A. Btool.log is used for configuration validation output, not runtime regex interpretation errors.
- B. Metrics.log tracks performance metrics, not regex parsing errors.
- D. Tailing_processor.log does not contain regex interpretation error details.
Question 16
Which component in the splunkd.log will log information related to bad event breaking?
Show answer and explanation
Correct answer: D. AggregatorMiningProcessor
The AggregatorMiningProcessor component in splunkd.log logs information related to bad event breaking, including issues with event segmentation and line breaking. This component handles the processing pipeline stages where event boundaries are determined and logs errors when breaking rules fail or produce unexpected results.
Why the other options are wrong
- A. Audittrail logs user actions and system changes, not event breaking issues.
- B. EventBreaking is not a recognized splunkd.log component name for this purpose.
- C. IndexingPipeline logs general indexing operations but not specifically bad event breaking details.
Question 17
The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?
Show answer and explanation
Correct answer: B. rawdata is: 15%, tsidx is: 35%
Splunk's guidance for syslog data sizing allocates the 50% compression ratio approximately 15% to rawdata files (the compressed original event data) and 35% to tsidx files (the time-series index files used for search acceleration), with the remainder accounting for other metadata and overhead.
Why the other options are wrong
- A. The 10%/40% split does not accurately reflect the standard syslog sizing guidance.
- C. The 35%/15% split reverses the correct allocation, assigning too much space to rawdata and too little to the critical tsidx files.
- D. The 40%/10% split heavily overweights rawdata at the expense of the tsidx component.
Question 18
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department. Which of the following items might be the cause for this issue?
Show answer and explanation
Correct answer: C. The indexers may have different configurations than the heavy forwarders.
When web logs flow through different paths (some through heavy forwarders, others through regular forwarders) and events are inconsistently formatted, the most likely cause is that the indexers and heavy forwarders have different parsing configurations. Heavy forwarders can perform parsing and field extraction, while regular forwarders cannot. If these components have different props.conf or transforms.conf settings, the same sourcetype will be processed differently depending on which path the data took.
Why the other options are wrong
- A. Search head configuration differences affect search behavior and knowledge objects, not input event formatting.
- B. Data input configuration issues would typically cause data to not arrive or fail entirely, not inconsistent formatting.
- D. Version differences might cause other issues but would not specifically cause inconsistent formatting for the same sourcetype across paths.
Question 19
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?
Show answer and explanation
Correct answer: D. False
When using LINE_BREAKER to define event boundaries in multi-line events, SHOULD_LINEMERGE must be set to False. This tells Splunk to rely on the LINE_BREAKER regex pattern to determine event boundaries rather than using the default line-merging behavior, ensuring that events are broken exactly where specified.
Why the other options are wrong
- A. Auto is not the appropriate setting when using LINE_BREAKER for explicit event delimitation.
- B. None is not a valid value for SHOULD_LINEMERGE.
- C. True enables line merging, which contradicts the purpose of using LINE_BREAKER for explicit boundaries.
Question 20
Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)
Show answer and explanation
Correct answer: B, D. Replicated data does not count against licensing; Cluster members must share the same license pool and license master.
In a clustered Splunk deployment, all cluster members must share the same license pool and license master to ensure consistent licensing across the cluster. Replicated data does not count against licensing because it represents duplicate data for redundancy purposes; only the original indexed data counts toward license consumption.
Why the other options are wrong
- A. Free licenses do support clustering; the restriction applies to some other advanced features.
- C. Cluster members share licenses through a central license master rather than each requiring individual licenses.
Question 21
A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?
Show answer and explanation
Correct answer: D. Configure syslog to write logs and use a Splunk forwarder to collect the logs.
The best practice is to configure syslog to write logs to files and then use a Splunk forwarder to collect those logs. This approach decouples syslog from Splunk, allows the forwarder to manage data delivery, provides queuing capabilities, and ensures reliability. Using a forwarder rather than ingesting directly into the indexer or sending raw syslog to Splunk provides better data handling, transformation, and failover capabilities.
Why the other options are wrong
- A. While multiple indexers should receive data for redundancy, this describes load distribution rather than the proper collection method.
- B. Having indexers listen directly on port 514 for syslog is not best practice; indexers should focus on indexing, not network data collection.
- C. A forwarder should collect from log files written by syslog, not act as the direct syslog receiver, which couples the forwarder tightly to syslog daemon operations.
Question 22
As a best practice, where should the internal licensing logs be stored?
Show answer and explanation
Correct answer: D. Search head layer.
Internal licensing logs should be stored on the Search Head layer as a best practice. Search heads provide the appropriate location for logging and monitoring licensing compliance, allowing administrators to query and audit license usage. Storing licensing logs on the search head layer ensures they are easily accessible for reporting and monitoring.
Why the other options are wrong
- A. The indexing layer stores operational data but is not the designated location for internal licensing logs.
- B. License server logs are separate from internal licensing logs and should not be the primary storage location.
- C. The deployment layer is for configuration management, not for storing licensing logs.
Question 23
A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?
Show answer and explanation
Correct answer: C. Two indexers clustered, assuming high availability is the greatest priority.
At roughly 300 GB per day per reference indexer, 600 GB per day with only six users fits on two indexers. Clustering them adds replication, which meets the high availability requirement at the lowest hardware cost. A heavy load of scheduled searches or long searches would lower per-indexer capacity and call for more indexers, not two.
Why the other options are wrong
- A. Unclustered indexers give no data replication, and many long searches would need more than two indexers anyway.
- B. Unclustered indexers give no high availability, and retention length affects storage rather than indexer count.
- D. A heavy scheduled search load reduces per-indexer ingest capacity, so two indexers would not be enough.
Question 24
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
Show answer and explanation
Correct answer: A. Distributes apps to SHC members.
The deployer's primary function is to distribute apps and configurations to Search Head Cluster members. It manages app deployment and ensures consistent configurations across the cluster. While it facilitates bootstrapping and configuration distribution, its core role is app distribution to cluster members.
Why the other options are wrong
- B. Bootstrapping is a manual process performed by administrators, not an automatic deployer function.
- C. Runtime knowledge object changes made by users are replicated directly between SHC members, not distributed by the deployer.
- D. User-made runtime changes propagate through SHC replication, not through the deployer.
Question 25
When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?
Show answer and explanation
Correct answer: A. They will continue to replicate within the origin site and age out based on existing policies.
When converting from a single-site to a multi-site cluster, existing single-site clustered buckets continue to replicate according to their original single-site replication policies within their origin site. They age out normally based on the existing retention policies. The transition does not immediately force rebalancing or stop replication of existing buckets.
Why the other options are wrong
- B. Buckets do not stop aging out; they continue to follow existing retention policies.
- C. Existing single-site buckets do not get replicated across all peers in the new multi-site topology; they remain governed by their original policies.
- D. Single-site buckets continue replicating within their origin site; they do not stop replicating.
Question 26
Before users can use a KV store, an admin must create a collection. Where is a collection is defined?
Show answer and explanation
Correct answer: C. collections.conf
KV store collections are defined in the collections.conf configuration file. This file specifies collection schemas, indexes, and other properties required for KV store functionality.
Why the other options are wrong
- A. kvstore.conf is used for general KV store settings, not for defining individual collections.
- B. collection.conf is not a valid configuration file in Splunk; the correct file name is collections.conf.
- D. kvcollections.conf is not a valid Splunk configuration file.
Question 27
Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)
Show answer and explanation
Correct answer: A, B. Is the job scheduler for the entire SHC; Manages alert action suppressions (throttling).
The captain of a search Head Cluster is the job scheduler for the entire cluster, responsible for running and managing all scheduled searches across the cluster. The captain also manages alert action suppressions (throttling) to prevent duplicate alert actions when the same alert is triggered across multiple members. These are the two primary responsibilities of the captain role.
Why the other options are wrong
- C. The captain does not synchronize the member list with the KV store primary; KV store replication is handled separately by KV store cluster mechanisms.
- D. Knowledge bundle replication to search peers is handled by the deployer and search peers, not the captain. The captain manages the knowledge bundle within the SHC but does not distribute it to search peers.
Question 28
Configurations from the deployer are merged into which location on the search head cluster member?
Show answer and explanation
Correct answer: D. SPLUNK_HOME/etc/apps/APP_HOME/default
Configurations pushed from the deployer to search head cluster members are merged into SPLUNK_HOME/etc/apps/APP_HOME/default. This preserves the application-specific directory structure and ensures configurations are applied at the appropriate precedence level within the app bundle.
Why the other options are wrong
- A. System-level local directory is not where app-specific deployer configurations are merged
- B. The local directory is for user-editable overrides, not for deployer-pushed configurations which go to default
- C. Search app default is too specific; deployer can push to any app, not just the search app
Question 29
Which of the following are client filters available in serverclass.conf? (Select all that apply.)
Show answer and explanation
Correct answer: A, B. DNS name; IP address.
Serverclass.conf supports client filtering by DNS name and IP address, allowing deployment clients to be targeted based on their network identity. Splunk server role and platform/machine type are not available as native client filter criteria in serverclass.conf; filtering relies on network-level identifiers.
Why the other options are wrong
- C. Splunk server role is not a supported client filter criterion in serverclass.conf.
- D. Platform or machine type is not a supported client filter criterion in serverclass.conf.
Question 30
Which command is used for thawing the archive bucket?
Show answer and explanation
Correct answer: C. Splunk rebuild
The splunk rebuild command is used to thaw archived buckets, converting them back into a searchable format. This command reconstructs the index files (.tsidx) from the rawdata files in an archived bucket.
Why the other options are wrong
- A. Splunk collect is used for collecting diagnostic information, not bucket thawing
- B. Splunk convert is used for format conversions and upgrades, not thawing buckets
- D. Splunk dbinspect is used for inspecting bucket metadata and integrity, not thawing
Question 31
In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?
Show answer and explanation
Correct answer: B. site_search_factor = origin:2, site2:1, total:4
The site_search_factor parameter defines the number of searchable copies required at each site. The configuration origin:2, site2:1, total:4 specifies two searchable copies at the origin site, one at site2, and four total searchable copies across the four-site cluster. The term 'search_factor' (not replication_factor) is correct, and site2 is used rather than site1 depending on the deployment configuration.
Why the other options are wrong
- A. This uses search_factor correctly but site1 specification doesn't match the requirement for site2.
- C. Replication_factor is used for replica copies, not searchable copies; this also references site1 incorrectly.
- D. Replication_factor controls total replica distribution, not searchable copy distribution which requires search_factor.
Question 32
What is the algorithm used to determine captaincy in a Splunk search head cluster?
Show answer and explanation
Correct answer: A. Raft distributed consensus.
Splunk uses the Raft distributed consensus algorithm to determine captaincy in a Search Head Cluster. Raft is a consensus algorithm that ensures all cluster members agree on a single captain through an election process. This provides reliable leader election and maintains cluster stability.
Why the other options are wrong
- B. Rapt is not a recognized consensus algorithm used in Splunk.
- C. Rift is not the algorithm used; Raft is the correct distributed consensus mechanism.
- D. Round-robin distribution is not a consensus algorithm and does not apply to captain election.
Question 33
Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)
Show answer and explanation
Correct answer: A, D. Install Enterprise Security on the deployer; Use the deployer to deploy Enterprise Security to the cluster members.
When installing Enterprise Security on a Search Head Cluster, you must install it on the deployer first, then use the deployer to distribute the configuration to all cluster members. The deployer acts as the centralized management point for Search Head Cluster configurations. Installing directly on individual cluster members bypasses the cluster's configuration management mechanism and would cause inconsistencies.
Why the other options are wrong
- B. Installing on a staging instance is not part of the standard ES deployment procedure for SHC.
- C. Copying configurations to the deployer happens through the normal installation and packaging process, not as a separate manual step.
Question 34
Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?
Show answer and explanation
Correct answer: D. Add more search peers and make sure forwarders distribute data evenly across all indexers.
When a distributed deployment is approaching capacity, adding more search peers (indexers) and ensuring even data distribution directly increases the indexing and search capacity of the system. This addresses the fundamental bottleneck by scaling out the indexing tier, enabling more concurrent searches and faster query execution across more resources.
Why the other options are wrong
- A. SSD replacement improves I/O but doesn't address the core capacity shortage when approaching limits.
- B. Adding search heads helps distribute search load but doesn't increase indexing capacity, which is the bottleneck.
- C. Rescheduling searches provides marginal relief but doesn't increase overall system capacity or performance.
Question 35
Which search will show all deployment client messages from the client (UF)?
Show answer and explanation
Correct answer: C. index=_internal component= DC* host=<uf> | stats count by message
Deployment client messages are logged to the _internal index, not _audit. The component for deployment client is DC (not DC*), and to view messages from a Universal Forwarder (UF), you filter by host=<uf>. The search should be index=_internal component=DC* host=<uf> to retrieve all deployment client messages from the specified UF.
Why the other options are wrong
- A. Uses _audit index which contains audit events, not deployment client internal logs
- B. Uses _audit index instead of _internal where deployment client messages are actually logged
- D. Uses DS* component for deployment server and _internal index, but filters by ds host instead of uf
Question 36
A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?
Show answer and explanation
Correct answer: B. Add another search head to the cluster.
When a search head cluster is skipping a large number of scheduled searches due to capacity constraints, adding another search head to the cluster increases the total computational resources available for scheduled search execution across the cluster.
Why the other options are wrong
- A. There is no separate 'job server' role that can be created to increase search head cluster capacity.
- C. Setting captain_is_adhoc_searchhead = true allows the captain to run ad hoc searches but does not increase scheduled search capacity.
- D. While increasing max_searches_per_cpu may provide marginal gains, it does not address the fundamental resource constraint; adding nodes is the proper scaling approach.
Question 37
Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)
Show answer and explanation
Correct answer: A, D. Identify number of scheduled or real-time searches; Verify if Technical Add-On needs to be installed onto both a search head or indexer.
Before installing a vendor-built Technical Add-On, you must identify the maximum number of forwarders it can support to ensure it scales to your environment, and verify whether it needs installation on both search heads and indexers since this affects deployment architecture. Understanding scheduled/real-time search counts and data model compatibility would be performance considerations, but the critical evaluation points are capacity and installation placement.
Why the other options are wrong
- B. While validating data model compatibility is useful, it is not a mandatory evaluation item before installing the add-on.
- C. Though identifying search counts may be helpful for performance tuning, it is not a required evaluation before installation.
Question 38
Which of the following should be included in a deployment plan?
Show answer and explanation
Correct answer: B. Current logging details and data source inventory.
A deployment plan must include current logging details and a data source inventory to establish the baseline from which the Splunk deployment will be built. This provides the foundation for understanding what data exists, where it resides, and how it is currently being captured. This information is essential for designing the topology, configuring inputs, and planning resource requirements.
Why the other options are wrong
- A. Business continuity and disaster recovery plans are separate strategic documents, not core components of a technical deployment plan.
- C. While future topology is helpful, current IT environment details are more immediately critical for deployment planning.
- D. Stakeholder lists are important but secondary to understanding the actual data sources and logging infrastructure that the deployment must accommodate.
Question 39
Which Splunk internal index contains license-related events?
Show answer and explanation
Correct answer: C. _internal
License-related events are contained in the _internal index. This index stores internal Splunk operations and system messages, including license utilization, quota information, and license warning events.
Why the other options are wrong
- A. The _audit index contains audit trail events related to user actions and configuration changes, not license data.
- B. The _license index does not exist; license data is stored in _internal.
- D. The _introspection index contains Splunk introspection data about host, process, and system metrics, not license information.
Question 40
Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)
Show answer and explanation
Correct answer: A, B. telnet; tcpdump
Telnet can be used to test basic TCP connectivity between a forwarder and indexer on the configured port (typically 9997), verifying that the connection path is open. Tcpdump captures network traffic at the packet level, allowing deep inspection of the actual data being transmitted between the two components and identification of communication issues. These are both network-level diagnostic tools essential for troubleshooting connectivity problems.
Why the other options are wrong
- C. splunk btool is used to validate configuration files and their precedence, not specifically for diagnosing live connection problems.
- D. splunk btprobe is not a standard Splunk diagnostic command for connection testing.
Question 41
How does the average run time of all searches relate to the available CPU cores on the indexers?
Show answer and explanation
Correct answer: C. Average run time increases as the number of CPU cores on the indexers decreases.
Search run time increases as the number of CPU cores on indexers decreases because fewer cores mean less parallel processing capacity. Indexers with more CPU cores can process search tasks in parallel, reducing overall search execution time. Conversely, when core count is reduced, the indexer must process operations sequentially or with less parallelism, resulting in longer average run times.
Why the other options are wrong
- A. Average search run time is directly affected by indexer CPU core count.
- B. Average run time does not decrease as cores decrease; the opposite is true.
- D. Average run time does not increase as cores increase; more cores improve performance and reduce run time.
Question 42
At which default interval does metrics.log generate a periodic report regarding license utilization?
Show answer and explanation
Correct answer: B. 30 seconds
The metrics.log file generates periodic license utilization reports at a default interval of 30 seconds, providing frequent snapshots of license usage across the Splunk deployment.
Why the other options are wrong
- A. 10 seconds is too frequent for the default metrics.log reporting interval.
- C. 60 seconds is too long for the default license utilization reporting frequency.
- D. 300 seconds (5 minutes) is much longer than the actual default interval.
Question 43
To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?
Show answer and explanation
Correct answer: C. repFactor = auto
To activate replication for an index in an indexer cluster, the repFactor = auto attribute must be configured in indexes.conf on all peer nodes. This setting enables automatic replication with a default replication factor determined by cluster settings.
Why the other options are wrong
- A. repFactor = 0 disables replication rather than activating it.
- B. replicate is not the correct attribute name; the proper attribute is repFactor.
- D. replicate = auto is not a valid Splunk configuration; the correct attribute name is repFactor, not replicate.
That was 43 of 172.
The full Splunk SPLK-2002 pack has all 172 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 72 free as one PDF by email. Get the Half Pack →