Splunk SPLK-2002 Splunk Enterprise Certified Architect Exam Online Training

Question #31

Which command will permanently decommission a peer node operating in an indexer cluster?

A . splunk stop -f
B . splunk offline -f
C . splunk offline –enforce-counts
D . splunk decommission –enforce counts

Reveal Solution Hide Solution

Question #32

Which CLI command converts a Splunk instance to a license slave?

A . splunk add licenses
B . splunk list licenser-slaves
C . splunk edit licenser-localslave
D . splunk list licenser-localslave

Reveal Solution Hide Solution

Question #33

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index.

Which of the following logs are included in this index? (Select all that apply.)

A . audit.log
B . metrics.log
C . disk_objects.log
D . resource_usage.log

Reveal Solution Hide Solution

Question #34

Which of the following can a Splunk diag contain?

A . Search history, Splunk users and their roles, running processes, indexed data
B . Server specs, current open connections, internal Splunk log files, index listings
C . KV store listings, internal Splunk log files, search peer bundles listings, indexed data
D . Splunk platform configuration details, Splunk users and their roles, current open connections, index listings

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

The following artifacts are included in a Splunk diag file:

Server specs. These are the specifications of the server that Splunk runs on, such as the CPU model, the memory size, the disk space, and the network interface. These specs can help understand the Splunk hardware requirements and performance.

Current open connections. These are the connections that Splunk has established with other Splunk instances or external sources, such as forwarders, indexers, search heads, license masters, deployment servers, and data inputs. These connections can help understand the Splunk network topology and communication.

Internal Splunk log files. These are the log files that Splunk generates to record its own activities, such as splunkd.log, metrics.log, audit.log, and others. These logs can help troubleshoot Splunk issues and monitor Splunk performance.

Index listings. These are the listings of the indexes that Splunk has created and configured, such as the index name, the index location, the index size, and the index attributes. These listings can help understand the Splunk data management and retention. The following artifacts are not included in a Splunk diag file:

Search history. This is the history of the searches that Splunk has executed, such as the search query,

the search time, the search results, and the search user. This history is not part of the Splunk diag file, but it can be accessed from the Splunk Web interface or the audit.log file.

Splunk users and their roles. These are the users that Splunk has created and assigned roles to, such as the user name, the user password, the user role, and the user capabilities. These users and roles are not part of the Splunk diag file, but they can be accessed from the Splunk Web interface or the authentication.conf and authorize.conf files.

KV store listings. These are the listings of the KV store collections and documents that Splunk has created and stored, such as the collection name, the collection schema, the document ID, and the document fields. These listings are not part of the Splunk diag file, but they can be accessed from the Splunk Web interface or the mongod.log file.

Indexed data. These are the data that Splunk indexes and makes searchable, such as the rawdata and the tsidx files. These data are not part of the Splunk diag file, as they may contain sensitive or confidential information. For more information, see Generate a diagnostic snapshot of your Splunk Enterprise deployment in the Splunk documentation.

Question #35

Which of the following are true statements about Splunk indexer clustering?

A . All peer nodes must run exactly the same Splunk version.
B . The master node must run the same or a later Splunk version than search heads.
C . The peer nodes must run the same or a later Splunk version than the master node.
D . The search head must run the same or a later Splunk version than the peer nodes.

Reveal Solution Hide Solution

Question #36

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk.

How many indexers are recommended for this deployment?

A . Two indexers not in a cluster, assuming users run many long searches.
B . Three indexers not in a cluster, assuming a long data retention period.
C . Two indexers clustered, assuming high availability is the greatest priority.
D . Two indexers clustered, assuming a high volume of saved/scheduled searches.

Reveal Solution Hide Solution

Question #37

To reduce the captain’s work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

A . adhoc_searchhead = true (on all members)
B . adhoc_searchhead = true (on the current captain)
C . captain_is_adhoc_searchhead = true (on all members)
D . captain_is_adhoc_searchhead = true (on the current captain)

Reveal Solution Hide Solution

Question #38

At which default interval does metrics.log generate a periodic report regarding license utilization?

A . 10 seconds
B . 30 seconds
C . 60 seconds
D . 300 seconds

Reveal Solution Hide Solution

Question #39

Which of the following is a good practice for a search head cluster deployer?

A . The deployer only distributes configurations to search head cluster members when they “phone home”.
B . The deployer must be used to distribute non-replicable configurations to search head cluster members.
C . The deployer must distribute configurations to search head cluster members to be valid configurations.
D . The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.

Reveal Solution Hide Solution

Question #40

A new Splunk customer is using syslog to collect data from their network devices on port 514.

What is the best practice for ingesting this data into Splunk?

A . Configure syslog to send the data to multiple Splunk indexers.
B . Use a Splunk indexer to collect a network input on port 514 directly.
C . Use a Splunk forwarder to collect the input on port 514 and forward the data.
D . Configure syslog to write logs and use a Splunk forwarder to collect the logs.

Reveal Solution Hide Solution