[Oct 11, 2023] SPLK-2002 Practice Exam Dumps - 99% Marks In Splunk Exam
Updated Verified SPLK-2002 Q&As - Pass Guarantee or Full Refund
NEW QUESTION # 24
The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?
- A. 0
- B. Unlimited
- C. 1
- D. 2
Answer: B
NEW QUESTION # 25
When troubleshooting monitor inputs, which command checks the status of the tailed files?
- A. splunk cmd btool check inputs layer
- B. splunk cmd btool inputs list | tail
- C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus
- D. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus
Answer: C
NEW QUESTION # 26
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Check deploymentclient.confof the deployment client.
- B. Check the content of SPLUNK_HOME/etc/appsof the deployment server.
- C. Search for relevant events in splunkd.logof the deployment server.
- D. Check serverclass.confof the deployment server.
Answer: A,B,D
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/177021/why-is-deployment-client-not-picking-up-changes- to.html
NEW QUESTION # 27
When should multiple search pipelines be enabled?
- A. Only if disk IOPS is at 800 or better.
- B. Only if CPU and memory resources are significantly under-utilized.
- C. Only if running Splunk Enterprise version 6.6 or later.
- D. Only if there are fewer than twelve concurrent users.
Answer: B
NEW QUESTION # 28
When configuring a Splunk indexer cluster, what are the default values for replication and search factor?
replication_factor = 2
- A. search factor = 3
replication_factor = 3 - B. search_factor = 2
replication_factor = 2 - C. search factor = 3
- D. search_factor = 2
replication_factor = 3
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Thesearchfactor
NEW QUESTION # 29
When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of
operations?
- A. 1. Initialize cluster rebalance operation.
2. Remove master node from cluster.
3. Trigger replication. - B. 1. Trigger replication.
2. Remove master node from cluster.
3. Initialize cluster rebalance operation. - C. 1. Delete Splunk Enterprise, if it exists.
2. Install and initialize the instance.
3. Join the SHC. - D. 1. Install and initialize the instance.
2. Delete Splunk Enterprise, if it exists.
3. Join the SHC.
Answer: D
NEW QUESTION # 30
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- A. Via Splunk Web.
- B. Run a splunk edit cluster-config command from the CLI.
- C. Directly edit SPLUNK_HOME/etc/system/local/server.conf
- D. Directly edit SPLUNK_HOME/etc/system/default/server.conf
Answer: A,C
NEW QUESTION # 31
Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)
- A. splunk btool
- B. splunk btprobe
- C. telnet
- D. tcpdump
Answer: A,D
NEW QUESTION # 32
A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?
- A. Two indexers not in a cluster, assuming users run many long searches.
- B. Two indexers clustered, assuming high availability is the greatest priority.
- C. Three indexers not in a cluster, assuming a long data retention period.
- D. Two indexers clustered, assuming a high volume of saved/scheduled searches.
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/ Summaryofperformancerecommendations
NEW QUESTION # 33
Which of the following is an indexer clustering requirement?
- A. Must share the same license pool.
- B. Must have at least three members.
- C. Must use shared storage.
- D. Must reside on a dedicated rack.
Answer: A
NEW QUESTION # 34
Which of the following commands is used to clear the KV store?
- A. splunk reinitialize kvstore
- B. splunk clean kvstore
- C. splunk clear kvstore
- D. splunk delete kvstore
Answer: B
NEW QUESTION # 35
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)
- A. The Typing Queue, which does regular expression replacements, is blocked.
- B. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.
- C. The field was extracted as a private knowledge object.
- D. The events are tagged as communicate, but are missing the network tag.
Answer: B
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/657187/map-command-field-not-being-evaluated.html
NEW QUESTION # 36
Which two sections can be expanded using the Search Job Inspector?
- A. Search job properties.
- B. Optimization suggestions.
- C. Saved search history.
- D. Execution costs.
Answer: A,C
NEW QUESTION # 37
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?
- A. True
- B. Auto
- C. False
- D. None
Answer: A
NEW QUESTION # 38
When planning a search head cluster, which of the following is true?
- A. All indexers must belong to the underlying indexer cluster (no standalone indexers).
- B. The search head captain must be assigned to the largest search head in the cluster.
- C. All search heads must use the same operating system.
- D. All search heads must be members of the cluster (no standalone search heads).
Answer: B
NEW QUESTION # 39
Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select
all that apply.)
- A. Install Enterprise Security on the deployer.
- B. Use the deployer to deploy Enterprise Security to the cluster members.
- C. Install Enterprise Security on a staging instance.
- D. Copy the Enterprise Security configurations to the deployer.
Answer: A,B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallEnterpriseSecuritySHC
NEW QUESTION # 40
Which server.conf attribute should be added to the master node's server.conf file when decommissioning a site in an indexer cluster?
- A. site_mappings
- B. site_search_factor
- C. site_replication_factor
- D. available_sites
Answer: A
NEW QUESTION # 41
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining
that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web
logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the
forwarders are managed by another department.
Which of the following items might be the cause for this issue?
- A. The data inputs are not properly configured across all the forwarders.
- B. The search head may have different configurations than the indexers.
- C. The forwarders managed by the other department are an older version than the rest.
- D. The indexers may have different configurations than the heavy forwarders.
Answer: D
NEW QUESTION # 42
Which of the following security options must be explicitly configured (i.e. which options are not enabled by
default)?
- A. Certificate authentication between Splunk Web and search head.
- B. Data encryption for distributed search between search heads and indexers.
- C. Data encryption between Splunk Web and splunkd.
- D. Certificate authentication between forwarders and indexers.
Answer: D
NEW QUESTION # 43
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)
- A. The Typing Queue, which does regular expression replacements, is blocked.
- B. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.
- C. The field was extracted as a private knowledge object.
- D. The events are tagged as communicate, but are missing the network tag.
Answer: B
NEW QUESTION # 44
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Search for relevant events in splunkd.log of the deployment server.
- B. Check deploymentclient.conf of the deployment client.
- C. Check serverclass.conf of the deployment server.
- D. Check the content of SPLUNK_HOME/etc/apps of the deployment server.
Answer: B,C,D
NEW QUESTION # 45
Which of the following statements describe search head clustering? (Select all that apply.)
- A. A deployer is required.
- B. Search heads must meet the high-performance reference server requirements.
- C. The deployer must have sufficient CPU and network resources to process service requests and push configurations.
- D. At least three search heads are needed.
Answer: B,D
NEW QUESTION # 46
How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?
- A. ITSI in a Splunk deployment does not require additional hardware resources.
- B. The amount of users using ITSI will not impact performance.
- C. Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.
- D. ITSI requires a dedicated deployment server.
Answer: C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan
NEW QUESTION # 47
Which of the following can a Splunk diag contain?
- A. KV store listings, internal Splunk log files, search peer bundles listings, indexed data
- B. Splunk platform configuration details, Splunk users and their roles, current open connections, index listings
- C. Search history, Splunk users and their roles, running processes, indexed data
- D. Server specs, current open connections, internal Splunk log files, index listings
Answer: D
NEW QUESTION # 48
......
SPLK-2002 Real Valid Brain Dumps With 92 Questions: https://www.prep4pass.com/SPLK-2002_exam-braindumps.html
SPLK-2002 Certification with Actual Questions: https://drive.google.com/open?id=1tUsiJrbQwqREu2dNprZ1vT0MkTS28dLE
