Download the Latest SPLK-2002 Dumps - 2021 SPLK-2002 Exam Questions
Latest Splunk SPLK-2002 Certification Practice Test Questions
Splunk SPLK-2002: Splunk Enterprise Certified Architect Exam topics
Candidates must know the exam topics before they start preparation. Because it will help them in hitting the core. Our splk-2002 dumps will include the following topics:
Module 1 â Introduction
- Overview of Buttercup Games Inc.
Module 2 â What is Splunk?
- Getting data into Splunk
- Installing Splunk
- Splunk components
Module 3 â Introduction to Splunk’s User Interface
- Define Splunk Apps
- Customizing your user settings
- Understand the uses of Splunk
- Learn basic navigation in Splunk
Module 4 â Basic Searching
- Identify the contents of search results
- Use autocomplete to help build a search
- Work with events
- Refine searches
- Set the time range of a search
- Save search results
- Use the timeline
- Run basic searches
- Control a search job
Module 5 â Using Fields in Searches
- Understand fields
- Use fields in searches
- Use the fields sidebar
Module 6 â Search Language Fundamentals
- Examine the search pipeline
- Use autocomplete and syntax highlighting
- Use SPL search commands to perform searches
- Specify indexes in searches
- Review basic search commands and general search practices
Module 7 â Using Basic Transforming Commands
- The rare command
- The top command
- The stats command
Module 8 â Creating Reports and Dashboards
- Create reports that include visualizations such as charts and tables
- Add a report to a dashboard
- Edit a dashboard
- Create a dashboard
- Edit reports
- Save a search as a report
Module 9 â Datasets and the Common Information Model
- What are datasets?
- Naming conventions
- What is the Common Information Model (CIM)?
Module 10 â Creating and Using Lookups
- Describe lookups
- Create a lookup file and create a lookup definition
- Configure an automatic lookup
Module 11 â Creating Scheduled Reports and Alerts
- Describe alerts
- Describe scheduled reports
- View fired alerts
- Configure scheduled reports
- Create alerts
Module 12 - Using Pivot
- Select a data model object
- Add a pivot report to a dashboard
- Understand the relationship between data models and pivot
- Create an instant pivot from a search
- Create a pivot report
- Describe Pivot
NEW QUESTION 15
In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?
- A. Parsing
- B. Indexing
- C. Input
- D. Search
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/ Configurationparametersandthedatapipeline
NEW QUESTION 16
Which of the following is a way to exclude search artifacts when creating a diag?
- A. SPLUNK_HOME/bin/splunk diag --exclude
- B. SPLUNK_HOME/bin/splunk diag --filter-searchstrings
- C. SPLUNK_HOME/bin/splunk diag --disable=dispatch
- D. SPLUNK_HOME/bin/splunk diag --debug --refresh
Answer: A
NEW QUESTION 17
A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?
- A. Three indexers not in a cluster, assuming a long data retention period.
- B. Two indexers not in a cluster, assuming users run many long searches.
- C. Two indexers clustered, assuming high availability is the greatest priority.
- D. Two indexers clustered, assuming a high volume of saved/scheduled searches.
Answer: D
NEW QUESTION 18
A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?
- A. 300GB. After this limit, search is locked out.
- B. Search is not locked out. Violations are still recorded.
- C. 500GB. After this limit, search is locked out.
- D. 800GB. After this limit, search is locked out.
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/TypesofSplunklicenses
NEW QUESTION 19
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)
- A. The events are tagged as communicate, but are missing the network tag.
- B. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.
- C. The field was extracted as a private knowledge object.
- D. The Typing Queue, which does regular expression replacements, is blocked.
Answer: B
NEW QUESTION 20
Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)
- A. Each cluster member requires its own clustering license.
- B. Free licenses do not support clustering.
- C. Replicated data does not count against licensing.
- D. Cluster members must share the same license pool and license master.
Answer: C,D
NEW QUESTION 21
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
- A. Bootstraps a clean Splunk install for a SHC.
- B. Distributes apps to SHC members.
- C. Distributes non-search related and manual configuration file changes.
- D. Distributes runtime knowledge object changes made by users across the SHC.
Answer: B,C
NEW QUESTION 22
What is a Splunk Job? (Select all that apply.)
- A. Searches that are subjected to some usage quota.
- B. A search process kicked off via a report or an alert.
- C. A child OS process manifested from the splunkd process.
- D. A user-defined Splunk capability.
Answer: D
NEW QUESTION 23
Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)
- A. Install Splunk apps.
- B. Inventory data sources.
- C. Use case checklist.
- D. Review network topology.
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 24
In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?
- A. Total daily indexing volume, number of peer nodes, and number of accelerated searches.
- B. Total daily indexing volume, number of peer nodes, replication factor, and search factor.
- C. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.
- D. Total daily indexing volume, replication factor, search factor, and number of search heads.
Answer: C
NEW QUESTION 25
The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?
- A. 0
- B. 1
- C. 2
- D. Unlimited
Answer: D
NEW QUESTION 26
Which of the following is a good practice for a search head cluster deployer?
- A. The deployer only distributes configurations to search head cluster members when they "phone home".
- B. The deployer must distribute configurations to search head cluster members to be valid configurations.
- C. The deployer only distributes configurations to search head cluster members with splunk apply
shcluster-bundle. - D. The deployer must be used to distribute non-replicable configurations to search head cluster members.
Answer: A
NEW QUESTION 27
In a distributed environment, knowledge object bundles are replicated from the search head to which location
on the search peer(s)?
- A. SPLUNK_HOME/var/lib/searchpeers
- B. SPLUNK_HOME/var/run/searchpeers
- C. SPLUNK_HOME/var/log/searchpeers
- D. SPLUNK_HOME/var/spool/searchpeers
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Whatsearchheadssend
NEW QUESTION 28
A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?
- A. Three indexers not in a cluster, assuming a long data retention period.
- B. Two indexers clustered, assuming high availability is the greatest priority.
- C. Two indexers not in a cluster, assuming users run many long searches.
- D. Two indexers clustered, assuming a high volume of saved/scheduled searches.
Answer: B
Explanation:
Explanation
https://docs.splunk.com/Documentation/Splunk/8.1.0/DistSearch/Distsearchsystemrequirements
NEW QUESTION 29
Which of the following is an indexer clustering requirement?
- A. Must use shared storage.
- B. Must reside on a dedicated rack.
- C. Must share the same license pool.
- D. Must have at least three members.
Answer: C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Distdeploylicenses
NEW QUESTION 30
Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)
- A. Adding search heads provides additional CPU cores to run more concurrent searches.
- B. Adding search peers increases the search throughput as search load increases.
- C. Adding RAM to an existing search heads provides additional search capacity.
- D. Adding search peers increases the maximum size of search results.
Answer: A,C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/ HowsavedsearchesaffectSplunkEnterpriseperformance
NEW QUESTION 31
Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)
- A. Is the job scheduler for the entire SHC.
- B. Manages alert action suppressions (throttling).
- C. Synchronizes the member list with the KV store primary.
- D. Replicates the SHC's knowledge bundle to the search peers.
Answer: A,D
NEW QUESTION 32
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- A. Directly edit SPLUNK_HOME/etc/system/default/server.conf
- B. Run a splunk edit cluster-config command from the CLI.
- C. Directly edit SPLUNK_HOME/etc/system/local/server.conf
- D. Via Splunk Web.
Answer: C,D
NEW QUESTION 33
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspection index. Which of the following logs are included in this index? (Select all that apply.)
- A. disk_objects.log
- B. metrics.log
- C. resource_usage.log
- D. audit.log
Answer: A,C
NEW QUESTION 34
Which of the following is an indexer clustering requirement?
- A. Must use shared storage.
- B. Must reside on a dedicated rack.
- C. Must share the same license pool.
- D. Must have at least three members.
Answer: C
NEW QUESTION 35
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- A. Directly edit SPLUNK_HOME/etc/system/default/server.conf
- B. Run a splunk edit cluster-configcommand from the CLI.
- C. Directly edit SPLUNK_HOME/etc/system/local/server.conf
- D. Via Splunk Web.
Answer: C,D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Enableclustersindetail
NEW QUESTION 36
When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?
- A. Restart the search head.
- B. Run the clean raft command on all members of the search head cluster.
- C. Run the splunk resync shcluster-replicated-config command on this member.
- D. Run the splunk apply shcluster-bundle command from the deployer.
Answer: C
Explanation:
Explanation
https://community.splunk.com/t5/Deployment-Architecture/How-to-resolve-error-quot-Error-pulling-configurati
NEW QUESTION 37
What is the minimum reference server specification for a Splunk indexer?
- A. 12 CPU cores, 12GB RAM, 800 IOPS
- B. 24 CPU cores, 16GB RAM, 1200 IOPS
- C. 16 CPU cores, 16GB RAM, 800 IOPS
- D. 28 CPU cores, 32GB RAM, 1200 IOPS
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/ Referencehardware#Reference_host_specification
NEW QUESTION 38
......
What is the duration, language, and format of Splunk SPLK-2002: Splunk Enterprise Certified Architect Exam
- Format: Multiple choices, multiple answers
- Passing Score 70%
- Number of Questions: 67
- Length of Examination: 90 minutes
Verified SPLK-2002 Dumps Q&As - 1 Year Free & Quickly Updates: https://www.passleadervce.com/Splunk-Enterprise-Certified-Architect/reliable-SPLK-2002-exam-learning-guide.html
Get 2021 Updated Free Splunk SPLK-2002 Exam Questions & Answer: https://drive.google.com/open?id=1Sk8kQMJcMux9SDMgj6XedT6OJICmVe_F