[Feb-2023] Latest Splunk SPLK-2002 Certification Practice Test Questions [Q28-Q42]

Rate this post

[Feb-2023] Latest Splunk SPLK-2002 Certification Practice Test Questions

Verified SPLK-2002 Dumps Q&As – 1 Year Free & Quickly Updates

NEW QUESTION 28
How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

ITSI requires a dedicated deployment server.

The amount of users using ITSI will not impact performance.

ITSI in a Splunk deployment does not require additional hardware resources.

Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.

Explanation/Reference: https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan

NEW QUESTION 29
Which of the following describe migration from single-site to multisite index replication?

A master node is required at each site.

Multisite policies apply to new data only.

Single-site buckets instantly receive the multisite policies.

Multisite total values should not exceed any single-site factors.

Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Migratetomultisite

NEW QUESTION 30
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

btool.log

metrics.log

splunkd.log

tailing_processor.log

NEW QUESTION 31
When troubleshooting monitor inputs, which command checks the status of the tailed files?
splunk cmd btool inputs list | tail

splunk cmd btool check inputs layer

curl https://serverhost:8089/services/admin/inputstatus/

TailingProcessor:FileStatus
curl https://serverhost:8089/services/admin/inputstatus/

TailingProcessor:Tailstatus

Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/ Troubleshoottheinputprocess#Troubleshoot_your_tailed_files

NEW QUESTION 32
Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

High performance SAN should never be used.

Enable NFS for storing hot and warm buckets.

The recommended RAID setup is RAID 10 (1 + 0).

Virtualized environments are usually preferred over bare metal for Splunk indexers.

Explanation/Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf

NEW QUESTION 33
A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

Configure syslog to send the data to multiple Splunk indexers.

Use a Splunk indexer to collect a network input on port 514 directly.

Use a Splunk forwarder to collect the input on port 514 and forward the data.

Configure syslog to write logs and use a Splunk forwarder to collect the logs.

Explanation/Reference: https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Monitornetworkports

NEW QUESTION 34
When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?

Restart the search head.

Run the splunk apply shcluster-bundle command from the deployer.

Run the clean raft command on all members of the search head cluster.

Run the splunk resync shcluster-replicated-config command on this member.

NEW QUESTION 35
Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Increasing the search factor in the cluster.

Increasing the replication factor in the cluster.

Increasing the number of search heads in the cluster.

Increasing the number of CPUs on the indexers in the cluster.

NEW QUESTION 36
Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

Increase the maximum number of hot buckets in indexes.conf

Increase the number of parallel ingestion pipelines in server.conf

Decrease the maximum size of the search pipelines in limits.conf

Decrease the maximum concurrent scheduled searches in limits.conf

NEW QUESTION 37
When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

Index and .tsidx files.

Rawdata and index files.

Compressed and .tsidx files.

Compressed and meta data files.

Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Aboutindexesandindexers

NEW QUESTION 38
As a best practice, where should the internal licensing logs be stored?

Indexing layer.

License server.

Deployment layer.

Search head layer.

Explanation/Reference: https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan

NEW QUESTION 39
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

Via Splunk Web.

Directly edit SPLUNK_HOME/etc/system/local/server.conf

Run a splunk edit cluster-config command from the CLI.

Directly edit SPLUNK_HOME/etc/system/default/server.conf

NEW QUESTION 40
To reduce the captain’s work load in a search head cluster, what setting will prevent scheduled searches from
running on the captain?

adhoc_searchhead = true(on all members)

adhoc_searchhead = true(on the current captain)

captain_is_adhoc_searchhead = true(on all members)

captain_is_adhoc_searchhead = true(on the current captain)

Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Adhocclustermember

NEW QUESTION 41
A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

300GB. After this limit, search is locked out.

500GB. After this limit, search is locked out.

800GB. After this limit, search is locked out.

Search is not locked out. Violations are still recorded.

Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/TypesofSplunklicenses

NEW QUESTION 42
Which of the following is an indexer clustering requirement?

Must use shared storage.

Must reside on a dedicated rack.

Must have at least three members.

Must share the same license pool.

Explanation
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Distdeploylicenses

Loading …