Question 1

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

Accepted Answer

Correct answer: A

Question 2

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

Accepted Answer

Correct answer: C

Question 3

What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

Accepted Answer

Correct answer: C

Question 4

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

Accepted Answer

Correct answer: BD

Question 5

In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of
the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

Accepted Answer

Correct answer: D

Question 6

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

Accepted Answer

Correct answer: C

Question 7

What is the minimum reference server specification for a Splunk indexer?

Accepted Answer

Correct answer: A

Question 8

/SPLK-2002-exam/ (90 Q&As)
Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

Accepted Answer

Correct answer: B

Question 9

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

Accepted Answer

Correct answer: D

Question 10

At which default interval does metrics.log generate a periodic report regarding license utilization?

Accepted Answer

Correct answer: B