SPLK-2002 Online Practice Questions and Answers

Which Splunk server role regulates the functioning of indexer cluster?

A. Indexer

B. Deployer

C. Master Node

D. Monitoring Console

Which of the following commands is used to clear the KV store?

A. splunk clean kvstore

B. splunk clear kvstore

C. splunk delete kvstore

D. splunk reinitialize kvstore

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

A. Configure syslog to send the data to multiple Splunk indexers.

B. Use a Splunk indexer to collect a network input on port 514 directly.

C. Use a Splunk forwarder to collect the input on port 514 and forward the data.

D. Configure syslog to write logs and use a Splunk forwarder to collect the logs.

To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

A. Rolling restart completes.

B. Master node rejoins the cluster.

C. Captain joins or rejoins cluster.

D. A peer node joins or rejoins the cluster.

The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

A. 25

B. 50

C. 100

D. Unlimited

What is the algorithm used to determine captaincy in a Splunk search head cluster?

A. Raft distributed consensus.

B. Rapt distributed consensus.

C. Rift distributed consensus.

D. Round-robin distribution consensus.

As a best practice, where should the internal licensing logs be stored?

A. Indexing layer.

B. License server.

C. Deployment layer.

D. Search head layer.

What is the default log size for Splunk internal logs?

A. 10MB

B. 20 MB

C. 25MB

D. 30MB

What is a Splunk Job? (Select all that apply.)

A. A user-defined Splunk capability.

B. Searches that are subjected to some usage quota.

C. A search process kicked off via a report or an alert.

D. A child OS process manifested from the splunkd process.

When Splunk is installed, where are the internal indexes stored by default?

A. SPLUNK_HOME/bin

B. SPLUNK_HOME/var/lib

C. SPLUNK_HOME/var/run

D. SPLUNK_HOME/etc/system/default