Splunk SPLK-2002 Exam Questions & Answers

In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.

What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

A. Total daily indexing volume, number of peer nodes, and number of accelerated searches.

B. Total daily indexing volume, number of peer nodes, replication factor, and search factor.

C. Total daily indexing volume, replication factor, search factor, and number of search heads.

D. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.

When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

A. Index and .tsidx files.

B. Rawdata and index files.

C. Compressed and .tsidx files.

D. Compressed and meta data files.

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

A. The field was extracted as a private knowledge object.

B. The events are tagged as communicate, but are missing the network tag.

C. The Typing Queue, which does regular expression replacements, is blocked.

D. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.