SPLK-2002 Online Practice Questions and Answers

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

A. 300GB. After this limit, search is locked out.

B. 500GB. After this limit, search is locked out.

C. 800GB. After this limit, search is locked out.

D. Search is not locked out. Violations are still recorded.

Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)

A. OS settings.

B. Internal logs.

C. Customer data.

D. Configuration files.

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk.

How many indexers are recommended for this deployment?

A. Two indexers not in a cluster, assuming users run many long searches.

B. Three indexers not in a cluster, assuming a long data retention period.

C. Two indexers clustered, assuming high availability is the greatest priority.

D. Two indexers clustered, assuming a high volume of saved/scheduled searches.

Which of the following is a good practice for a search head cluster deployer?

A. The deployer only distributes configurations to search head cluster members when they "phone home".

B. The deployer must be used to distribute non-replicable configurations to search head cluster members.

C. The deployer must distribute configurations to search head cluster members to be valid configurations.

D. The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.

In the deployment planning process, when should a person identify who gets to see network data?

A. Deployment schedule

B. Topology diagramming

C. Data source inventory

D. Data policy definition

Which of the following is a way to exclude search artifacts when creating a diag?

A. SPLUNK_HOME/bin/splunk diag --exclude

B. SPLUNK_HOME/bin/splunk diag --debug --refresh

C. SPLUNK_HOME/bin/splunk diag --disable=dispatch

D. SPLUNK_HOME/bin/splunk diag --filter-searchstrings

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

A. Free licenses do not support clustering.

B. Replicated data does not count against licensing.

C. Each cluster member requires its own clustering license.

D. Cluster members must share the same license pool and license master.

Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

A. A Hadoop application can search data in Splunk.

B. Splunk can search data in the Hadoop File System (HDFS).

C. You can use Splunk alerts to provision actions on a third-party system.

D. You can forward data from Splunk forwarder to a third-party system without indexing it first.

Which two sections can be expanded using the Search Job Inspector?

A. Execution costs.

B. Saved search history.

C. Search job properties.

D. Optimization suggestions.

When Splunk is installed, where are the internal indexes stored by default?

A. SPLUNK_HOME/bin

B. SPLUNK_HOME/var/lib

C. SPLUNK_HOME/var/run

D. SPLUNK_HOME/etc/system/default