SPLK-2002 Splunk Exam Questions and Free Practice Test

Question 13

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

A. Two indexers not in a cluster, assuming users run many long searches.

B. Three indexers not in a cluster, assuming a long data retention period.

C. Two indexers clustered, assuming high availability is the greatest priority.

D. Two indexers clustered, assuming a high volume of saved/scheduled searches.

Correct Answer:D

Question 14

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

A. 1. Delete Splunk Enterprise, if it exists.2. Install and initialize the instance.3. Join the SHC.

B. 1. Install and initialize the instance.2. Delete Splunk Enterprise, if it exists.3. Join the SHC.

C. 1. Initialize cluster rebalance operation.2. Remove master node from cluster.3. Trigger replication.

D. 1. Trigger replication.2. Remove master node from cluster.3. Initialize cluster rebalance operation.

Correct Answer:B

Question 15

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

A. audit.log

B. metrics.log

C. disk_objects.log

D. resource_usage.log

Correct Answer:CD

Question 16

In the deployment planning process, when should a person identify who gets to see network data?

A. Deployment schedule

B. Topology diagramming

C. Data source inventory

D. Data policy definition

Correct Answer:C

START SPLK-2002 EXAM