Splunk SPLK-2002 Exam Dumps (V9.02) – Accurate Learning Resources to Pass Your Splunk Enterprise Certified Architect Exam on the First Attempt

1. Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

2. Stakeholders have identified high availability for searchable data as their top priority.

Which of the following best addresses this requirement?

3. Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity.

Which of the following options will provide the most search performance improvement?

4. A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web source. Further investigation reveals that not all weblogs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.

Which of the following items might be the cause of this issue?

5. A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master.

How much data can the customer ingest before the search is locked out?

6. What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

7. When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

8. Which of the following should be included in a deployment plan?

9. A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

10. Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

11. Which of the following are client filters available in serverclass.conf? (Select all that apply.)

12. What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

13. Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk deployment?

14. In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

15. Which of the following is true regarding Splunk Enterprise's performance? (Select all that apply.)

16. Which Splunk Enterprise offering has its own license?

17. Which component in the splunkd.log will log information related to bad event breaking?

18. Which Splunk server role regulates the functioning of indexer cluster?

19. When adding or rejoining a member to a search head cluster, the following error is displayed: Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.

What corrective action should be taken?

20. Which of the following commands is used to clear the KV store?

21. Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers.

Which of the following is most likely to improve indexing performance?

22. The guidance Splunk gives for estimating size on for syslog data is 50% of original data size.

How does this divide between files in the index?

23. In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for raw data and about 70% for index files.

What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

24. A three-node search head cluster is skipping a large number of searches across time.

What should be done to increase scheduled search capacity on the search head cluster?

25. The frequency in which a deployment client contacts the deployment server is controlled by what?

26. To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

27. Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

28. What is the minimum reference server specification for a Splunk indexer?

29. Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

30. Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)

31. Which command will permanently decommission a peer node operating in an indexer cluster?

32. Which CLI command converts a Splunk instance to a license slave?

33. Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index.

Which of the following logs are included in this index? (Select all that apply.)

34. Which of the following can a Splunk diag contain?

35. Which of the following are true statements about Splunk indexer clustering?

36. A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk.

How many indexers are recommended for this deployment?

37. To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

38. At which default interval does metrics.log generate a periodic report regarding license utilization?

39. Which of the following is a good practice for a search head cluster deployer?

40. A new Splunk customer is using syslog to collect data from their network devices on port 514.

What is the best practice for ingesting this data into Splunk?

41. Which Splunk internal index contains license-related events?

42. Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

43. Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

44. Which search will show all deployment client messages from the client (UF)?

45. To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

46. Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

47. Configurations from the deployer are merged into which location on the search head cluster member?

48. When Splunk indexes data in a non-clustered environment, what kind of files does it create by default?

49. How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

50. In the deployment planning process, when should a person identify who gets to see network data?

51. The KV store forms its own cluster within a SHC.

What is the maximum number of SHC members KV store will form?

52. In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)

53. Which command is used for thawing the archive bucket?

54. A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:

[clustering]

mode = master

replication_factor = 2

pass4SymmKey = password123

Which of the following statements describe this Splunk instance? (Select all that apply.)

55. Which of the following describe migration from single-site to multisite index replication?

56. What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

57. Which of the following is a way to exclude search artifacts when creating a diag?

58. Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

59. When planning a search head cluster, which of the following is true?

60. In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?