[Nov-2021] Free SPLK-2002 Exam Questions SPLK-2002 Actual Free Exam Questions
Verified SPLK-2002 dumps and 92 unique questions
Conclusion
The Splunk SPLK-2002 exam leads to one of the most highly-rated Splunk certifications, which equips an architect with the relevant knowledge needed for the desired boost in their career. The test assesses one's knowledge of the different uses of the Splunk Enterprise environment and how to apply it when performing daily tasks. It paves way for advancement and assimilation into some of the most rewarding Splunk careers.
The Splunk Enterprise Certified Architect SPLK-2002 test has been formed to explore the skills of enterprise architects and validate them to ensure efficient work. The exam focuses on how well the professional can use the Splunk Deployment Methodology and assesses if one can make use of the best practices needed to plan and collect data as well as size it for a distributed placement. The candidate will also have to showcase his or her abilities in managing and troubleshooting a standard distribution deployment using an indexer along with search head clusters.
NEW QUESTION 45
Stakeholders have identified high availability for searchable data as their top priority. Which of the following
best addresses this requirement?
- A. Increasing the number of search heads in the cluster.
- B. Increasing the replication factor in the cluster.
- C. Increasing the search factor in the cluster.
- D. Increasing the number of CPUs on the indexers in the cluster.
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture
NEW QUESTION 46
How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?
- A. ITSI in a Splunk deployment does not require additional hardware resources.
- B. The amount of users using ITSI will not impact performance.
- C. Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.
- D. ITSI requires a dedicated deployment server.
Answer: C
NEW QUESTION 47
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Search for relevant events in splunkd.logof the deployment server.
- B. Check deploymentclient.confof the deployment client.
- C. Check the content of SPLUNK_HOME/etc/appsof the deployment server.
- D. Check serverclass.confof the deployment server.
Answer: B,C,D
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/177021/why-is-deployment-client-not-picking-up-changes- to.html
NEW QUESTION 48
A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?
- A. Two indexers not in a cluster, assuming users run many long searches.
- B. Two indexers clustered, assuming a high volume of saved/scheduled searches.
- C. Two indexers clustered, assuming high availability is the greatest priority.
- D. Three indexers not in a cluster, assuming a long data retention period.
Answer: B
NEW QUESTION 49
Which of the following should be included in a deployment plan?
- A. A comprehensive list of stakeholders, either direct or indirect.
- B. Current and future topology diagrams of the IT environment.
- C. Business continuity and disaster recovery plans.
- D. Current logging details and data source inventory.
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/CoE/ssf/Handbook/StakeholderReg
NEW QUESTION 50
Which of the following is an indexer clustering requirement?
- A. Must use shared storage.
- B. Must reside on a dedicated rack.
- C. Must share the same license pool.
- D. Must have at least three members.
Answer: C
NEW QUESTION 51
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- A. Directly edit SPLUNK_HOME/etc/system/local/server.conf
- B. Directly edit SPLUNK_HOME/etc/system/default/server.conf
- C. Run a splunk edit cluster-config command from the CLI.
- D. Via Splunk Web.
Answer: A,C,D
NEW QUESTION 52
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Check serverclass.conf of the deployment server.
- B. Check deploymentclient.conf of the deployment client.
- C. Search for relevant events in splunkd.log of the deployment server.
- D. Check the content of SPLUNK_HOME/etc/apps of the deployment server.
Answer: A,B,C
NEW QUESTION 53
Which Splunk server role regulates the functioning of indexer cluster?
- A. Indexer
- B. Deployer
- C. Master Node
- D. Monitoring Console
Answer: C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Deploy/Indexercluster
NEW QUESTION 54
When troubleshooting monitor inputs, which command checks the status of the tailed files?
splunk cmd btool inputs list | tail
- A. TailingProcessor:Tailstatus
- B. curl https://serverhost:8089/services/admin/inputstatus/
- C. splunk cmd btool check inputs layer
- D. TailingProcessor:FileStatus
curl https://serverhost:8089/services/admin/inputstatus/
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/ Troubleshoottheinputprocess#Troubleshoot_your_tailed_files
NEW QUESTION 55
Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)
- A. Internal logs.
- B. Customer data.
- C. OS settings.
- D. Configuration files.
Answer: A,D
NEW QUESTION 56
When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?
- A. Restart the search head.
- B. Run the splunk apply shcluster-bundle command from the deployer.
- C. Run the clean raft command on all members of the search head cluster.
- D. Run the splunk resync shcluster-replicated-config command on this member.
Answer: D
Explanation:
Explanation
https://community.splunk.com/t5/Deployment-Architecture/How-to-resolve-error-quot-Error-pulling-configurati
NEW QUESTION 57
In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?
- A. Search
- B. Input
- C. Indexing
- D. Parsing
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/ Configurationparametersandthedatapipeline
NEW QUESTION 58
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- A. Directly edit SPLUNK_HOME/etc/system/local/server.conf
- B. Directly edit SPLUNK_HOME/etc/system/default/server.conf
- C. Run a splunk edit cluster-configcommand from the CLI.
- D. Via Splunk Web.
Answer: A,D
Explanation:
Explanation
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Enableclustersindetail
NEW QUESTION 59
Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?
- A. Decreasing the data model acceleration range.
- B. Increasing the number of buckets per index.
- C. Setting the cluster replication factor to N-1.
- D. Setting the cluster search factor to N-1.
Answer: C
NEW QUESTION 60
Which search will show all deployment client messages from the client (UF)?
- A. index=_audit component=DC* host=<uf> | stats count by message
- B. index=_audit component=DC* host=<ds> | stats count by message
- C. index=_internal component=DS* host=<ds> | stats count by message
- D. index=_internal component= DC* host=<uf> | stats count by message
Answer: C
NEW QUESTION 61
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
- A. Distributes runtime knowledge object changes made by users across the SHC.
- B. Distributes non-search related and manual configuration file changes.
- C. Distributes apps to SHC members.
- D. Bootstraps a clean Splunk install for a SHC.
Answer: B,C
NEW QUESTION 62
A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?
- A. server.conf captain_is_adhoc_searchhead = true.
- B. Create a job server on the cluster.
- C. Change limits.conf value for max_searches_per_cpu to a higher value.
- D. Add another search head to the cluster.
Answer: C
NEW QUESTION 63
What is a Splunk Job? (Select all that apply.)
- A. A search process kicked off via a report or an alert.
- B. Searches that are subjected to some usage quota.
- C. A child OS process manifested from the splunkd process.
- D. A user-defined Splunk capability.
Answer: D
NEW QUESTION 64
Which of the following is a way to exclude search artifacts when creating a diag?
- A. SPLUNK_HOME/bin/splunk diag --disable=dispatch
- B. SPLUNK_HOME/bin/splunk diag --exclude
- C. SPLUNK_HOME/bin/splunk diag --filter-searchstrings
- D. SPLUNK_HOME/bin/splunk diag --debug --refresh
Answer: B
Explanation:
Explanation
Explanation/Reference: https://splunkonbigdata.com/2018/10/01/splunk-diag/
NEW QUESTION 65
Which component in the splunkd.logwill log information related to bad event breaking?
- A. EventBreaking
- B. IndexingPipeline
- C. AggregatorMiningProcessor
- D. Audittrail
Answer: C
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/141721/error-in-splunkd-log-breaking-event-because-limit-of-
256-has-been-exceeded.html
NEW QUESTION 66
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Search for relevant events in splunkd.logof the deployment server.
- B. Check deploymentclient.confof the deployment client.
- C. Check the content of SPLUNK_HOME/etc/appsof the deployment server.
- D. Check serverclass.confof the deployment server.
Answer: B,C,D
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/177021/why-is-deployment-client-not-picking-up-changes-
to.html
NEW QUESTION 67
Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select
all that apply.)
- A. telnet
- B. splunk btprobe
- C. splunk btool
- D. tcpdump
Answer: C,D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Security/
Troubleshootyouforwardertoindexerauthentication
NEW QUESTION 68
Which of the following can a Splunk diagcontain?
- A. Search history, Splunk users and their roles, running processes, indexed data
- B. KV store listings, internal Splunk log files, search peer bundles listings, indexed data
- C. Server specs, current open connections, internal Splunk log files, index listings
- D. Splunk platform configuration details, Splunk users and their roles, current open connections, index listings
Answer: C
Explanation:
Explanation/Reference: https://splunkonbigdata.com/2018/10/01/splunk-diag/
NEW QUESTION 69
Which of the following is a way to exclude search artifacts when creating a diag?
- A. SPLUNK_HOME/bin/splunk diag --disable=dispatch
- B. SPLUNK_HOME/bin/splunk diag --exclude
- C. SPLUNK_HOME/bin/splunk diag --filter-searchstrings
- D. SPLUNK_HOME/bin/splunk diag --debug --refresh
Answer: B
NEW QUESTION 70
......
Latest 100% Passing Guarantee - Brilliant SPLK-2002 Exam Questions PDF: https://www.realexamfree.com/SPLK-2002-real-exam-dumps.html
SPLK-2002 Dumps for Pass Guaranteed - Pass SPLK-2002 Exam: https://drive.google.com/open?id=1dLzfBXZOjsEIp_DcHoTwMy09toAMPe8m
