Online SPLK-2002 Practice TestMore Splunk Products >

Free Splunk SPLK-2002 Exam Dumps Questions

Splunk SPLK-2002: Splunk Enterprise Certified Architect

- Get instant access to SPLK-2002 practice exam questions

- Get ready to pass the Splunk Enterprise Certified Architect exam right now using our Splunk SPLK-2002 exam package, which includes Splunk SPLK-2002 practice test plus an Splunk SPLK-2002 Exam Simulator.

- The best online SPLK-2002 exam study material and preparation tool is here.

4.5

(3195 ratings)

Question 1

Which command will permanently decommission a peer node operating in an
indexer cluster?

A. splunk stop -f

B. splunk offline -f

C. splunk offline --enforce-counts

D. splunk decommission --enforce counts

Correct Answer:C

Question 2

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

A. adhoc_searchhead = true (on all members)

B. adhoc_searchhead = true (on the current captain)

C. captain_is_adhoc_searchhead = true (on all members)

D. captain_is_adhoc_searchhead = true (on the current captain)

Correct Answer:D

Question 3

A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

A. Create a job server on the cluster.

B. Add another search head to the cluster.

C. server.conf captain_is_adhoc_searchhead = true.

D. Change limits.conf value for max_searches_per_cpu to a higher value.

Correct Answer:D

Question 4

Which of the following commands is used to clear the KV store?

A. splunk clean kvstore

B. splunk clear kvstore

C. splunk delete kvstore

D. splunk reinitialize kvstore

Correct Answer:A

Question 5

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

A. The field was extracted as a private knowledge object.

B. The events are tagged as communicate, but are missing the network tag.

C. The Typing Queue, which does regular expression replacements, is blocked.

D. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Correct Answer:D

Question 6

What is the default log size for Splunk internal logs?

A. 10MB

B. 20 MB

C. 25MB

D. 30MB

Correct Answer:C

START SPLK-2002 EXAM