Practice SPLK-2002 Exam Online

Question 1

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

A : Disables search site affinity.

B : Sets all members to dynamic captaincy.

C : Enables multisite search artifact replication.

D : Enables automatic search site affinity discovery.

Answer: A

Question 2

When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

A :

replication_factor = 2search_factor = 2

B : replication_factor = 2search factor = 3

C :

replication_factor = 3search_factor = 2

D :

replication_factor = 3search factor = 3

Answer: C

Question 3

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

A : Increasing the search factor in the cluster.

B : Increasing the replication factor in the cluster.

C : Increasing the number of search heads in the cluster.

D : Increasing the number of CPUs on the indexers in the cluster.

Answer: B

Question 4

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

A : The field was extracted as a private knowledge object.

B : The events are tagged as communicate, but are missing the network tag.

C : The Typing Queue, which does regular expression replacements, is blocked.

D : The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Answer: D

Question 5

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

A :

Distributes apps to SHC members.

B :

Bootstraps a clean Splunk install for a SHC.

C : Distributes non-search related and manual configuration file changes.

D : Distributes runtime knowledge object changes made by users across the SHC.

Answer: A

Name:	Splunk Enterprise Certified Architect
Exam Code:	SPLK-2002
Certification:	Splunk Enterprise Certified Admin
Vendor:	Splunk
Total Questions:	90
Last Updated:	Apr 25, 2024

Splunk SPLK-2002