SPLK-2002Preview

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.
Which of the following items might be the cause for this issue?

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

Which of the following should be included in a deployment plan?

A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?

Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

Which of the following are true statements about Splunk indexer clustering?

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

Configurations from the deployer are merged into which location on the search head cluster member?

The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering]
mode = master
replication_factor = 2
pass4SymmKey = password123
Which of the following statements describe this Splunk instance? (Select all that apply.)

Which of the following describe migration from single-site to multisite index replication?

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

When planning a search head cluster, which of the following is true?

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

As a best practice, where should the internal licensing logs be stored?

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

What is a Splunk Job? (Select all that apply.)

Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)

Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)