Splunk SPLK-2002 Splunk Enterprise Certified Architect Exam Online Training
Splunk SPLK-2002 Online Training
The questions for SPLK-2002 were last updated at Feb 20,2025.
- Exam Code: SPLK-2002
- Exam Name: Splunk Enterprise Certified Architect Exam
- Certification Provider: Splunk
- Latest update: Feb 20,2025
Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers.
Which of the following is most likely to improve indexing performance?
- A . Increase the maximum number of hot buckets in indexes.conf
- B . Increase the number of parallel ingestion pipelines in server.conf
- C . Decrease the maximum size of the search pipelines in limits.conf
- D . Decrease the maximum concurrent scheduled searches in limits.conf
The guidance Splunk gives for estimating size on for syslog data is 50% of original data size.
How does this divide between files in the index?
- A . rawdata is: 10%, tsidx is: 40%
- B . rawdata is: 15%, tsidx is: 35%
- C . rawdata is: 35%, tsidx is: 15%
- D . rawdata is: 40%, tsidx is: 10%
In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for raw data and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?
- A . Total daily indexing volume, number of peer nodes, and number of accelerated searches.
- B . Total daily indexing volume, number of peer nodes, replication factor, and search factor.
- C . Total daily indexing volume, replication factor, search factor, and number of search heads.
- D . Replication factor, search factor, number of accelerated searches, and total disk size across cluster.
A three-node search head cluster is skipping a large number of searches across time.
What should be done to increase scheduled search capacity on the search head cluster?
- A . Create a job server on the cluster.
- B . Add another search head to the cluster.
- C . server.conf captain_is_adhoc_searchhead = true.
- D . Change limits.conf value for max_searches_per_cpu to a higher value.
The frequency in which a deployment client contacts the deployment server is controlled by what?
- A . polling_interval attribute in outputs.conf
- B . phoneHomeIntervalInSecs attribute in outputs.conf
- C . polling_interval attribute in deploymentclient.conf
- D . phoneHomeIntervalInSecs attribute in deploymentclient.conf
To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?
- A . repFactor = 0
- B . replicate = 0
- C . repFactor = auto
- D . replicate = auto
Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)
- A . Check serverclass.conf of the deployment server.
- B . Check deploymentclient.conf of the deployment client.
- C . Check the content of SPLUNK_HOME/etc/apps of the deployment server.
- D . Search for relevant events in splunkd.log of the deployment server.
What is the minimum reference server specification for a Splunk indexer?
- A . 12 CPU cores, 12GB RAM, 800 IOPS
- B . 16 CPU cores, 16GB RAM, 800 IOPS
- C . 24 CPU cores, 16GB RAM, 1200 IOPS
- D . 28 CPU cores, 32GB RAM, 1200 IOPS
Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?
- A . Data encryption between Splunk Web and splunkd.
- B . Certificate authentication between forwarders and indexers.
- C . Certificate authentication between Splunk Web and search head.
- D . Data encryption for distributed search between search heads and indexers.
Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)
- A . OS settings.
- B . Internal logs.
- C . Customer data.
- D . Configuration files.
Latest SPLK-2002 Dumps Valid Version with 90 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
