SPLK-2002 V1

A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf: [clustering] mode = master replication_factor = 2 pass4SymmKey = password123 Which of the following statements describe this Splunk instance? (Select all that apply.)A . This is a multi-site cluster.B . This cluster's search factor is 2.C . This Splunk instance needs...

Which CLI command converts a Splunk instance to a license slave?A . splunk add licensesB . splunk list licenser-slavesC . splunk edit licenser-localslaveD . splunk list licenser-localslaveView AnswerAnswer: C Explanation: The splunk edit licenser-localslave command is used to convert a Splunk instance to a license slave. This command will configure...

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?A . ITSI requires a dedicated deployment server.B . The amount of users using ITSI will not impact performance.C . ITSI in a Splunk deployment does not require additional hardware resources.D . Depending on the Key Performance Indicators...

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?A . Increasing the search factor in the cluster.B . Increasing the replication factor in the cluster.C . Increasing the number of search heads in the cluster.D . Increasing the number...

Which component in the splunkd.log will log information related to bad event breaking?A . AudittrailB . EventBreakingC . IndexingPipelineD . AggregatorMiningProcessorView AnswerAnswer: D Explanation: The AggregatorMiningProcessor component in the splunkd.log file will log information related to bad event breaking. The AggregatorMiningProcessor is responsible for breaking the incoming data into events...

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?A . repFactor = 0B . replicate = 0C . repFactor = autoD . replicate = autoView AnswerAnswer: C Explanation: To activate replication for an index in an indexer cluster,...

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)A . REPORTB . LINE_BREAKERC . ANNOTATE_PUNCTD . SHOULD_LINEMERGEView AnswerAnswer: B, D Explanation: The index-time props.conf attributes that impact indexing performance are LINE_BREAKER and SHOULD_LINEMERGE. These attributes determine how Splunk breaks the incoming data into events and whether it merges...

Which of the following is true regarding Splunk Enterprise's performance? (Select all that apply.)A . Adding search peers increases the maximum size of search results.B . Adding RAM to existing search heads provides additional search capacity.C . Adding search peers increases the search throughput as the search load increases.D ....

The frequency in which a deployment client contacts the deployment server is controlled by what?A . polling_interval attribute in outputs.confB . phoneHomeIntervalInSecs attribute in outputs.confC . polling_interval attribute in deploymentclient.confD . phoneHomeIntervalInSecs attribute in deploymentclient.confView AnswerAnswer: D Explanation: The frequency in which a deployment client contacts the deployment server is...

Which Splunk internal index contains license-related events?A . _auditB . _licenseC . _internalD . _introspectionView AnswerAnswer: C Explanation: The _internal index contains license-related events, such as the license usage, the license quota, the license pool, the license stack, and the license violations. These events are logged by the license manager...