Splunk Enterprise Certified Architect Exam SPLK-2002 Dumps Online

1. Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

2. Stakeholders have identified high availability for searchable data as their top priority.

Which of the following best addresses this requirement?

3. Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity.

Which of the following options will provide the most search performance improvement?

4. A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.

Which of the following items might be the cause for this issue?

5. A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master.

How much data can the customer ingest before search is locked out?

6. What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

7. When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

8. Which of the following should be included in a deployment plan?

9. A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

10. Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

11. Which of the following are client filters available in serverclass.conf? (Select all that apply.)

12. What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

13. Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk deployment?

14. In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

15. Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

16. Which Splunk Enterprise offering has its own license?

17. Which component in the splunkd.log will log information related to bad event breaking?

18. Which Splunk server role regulates the functioning of indexer cluster?

19. When adding or rejoining a member to a search head cluster, the following error is displayed:

Error pulling configurations from the search head cluster captain; consider performing a destructiveconfiguration resync on this search head cluster member.

What corrective action should be taken?

20. Which of the following commands is used to clear the KV store?

21. Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers.

Which of the following is most likely to improve indexing performance?

22. The guidance Splunk gives for estimating size on for syslog data is 50% of original data size.

How does this divide between files in the index?

23. In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.

What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

24. A three-node search head cluster is skipping a large number of searches across time.

What should be done to increase scheduled search capacity on the search head cluster?

25. The frequency in which a deployment client contacts the deployment server is controlled by what?

26. To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

27. Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

28. What is the minimum reference server specification for a Splunk indexer?

29. Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

30. Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)