Splunk Enterprise Certified Architect - SPLK-2002 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

(What is a recommended way to improve search performance?)

A. Leverage the not expression to limit returned results. B. Filter as much as possible in the initial search. C. Use the shortest query possible. D. Use non-streaming commands as early as possible.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 2

Configurations from the deployer are merged into which location on the search head cluster member?

A. SPLUNK_HOME/etc/apps/search/default B. SPLUNK_HOME/etc/apps/APP_HOME/local C. SPLUNK_HOME/etc/apps/APP_HOME/default D. SPLUNK_HOME/etc/system/local

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

(A customer has a Splunk Enterprise deployment and wants to collect data from universal forwarders. What is the best step to secure log traffic?)

A. Create signed SSL certificates and use them to encrypt data between the forwarders and indexers. B. Use the Splunk provided SSL certificates to encrypt data between the forwarders and indexers. C. Ensure all forwarder traffic is routed through a web application firewall (WAF). D. Create signed SSL certificates and use them to encrypt data between the search heads and indexers.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 4

A Splunk instance has crashed, but no crash log was generated. There is an attempt to determine what user activity caused the crash by running the following search:

What does searching for closed_txn=0 do in this search?

A. Filters results to situations where Splunk was started and stopped multiple times. B. Filters results to situations where Splunk was stopped and then immediately restarted. C. Filters results to situations where Splunk was started, but not stopped. D. Filters results to situations where Splunk was started and stopped once.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

(If the maxDataSize attribute is set to auto_high_volume in indexes.conf on a 64-bit operating system, what is the maximum hot bucket size?)

A. 1 GB B. 10 GB C. 750 MB D. 4 GB

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

(A customer has converted a CSV lookup to a KV Store lookup. What must be done to make it available for an automatic lookup?)

A. Add the replicate=true attribute in lookups.conf. B. Add the replicate=true attribute in collections.conf. C. Add the repFactor=true attribute in lookups.conf. D. Add the repFactor=true attribute in collections.conf.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Which command will permanently decommission a peer node operating in an indexer cluster?

A. splunk stop -f B. splunk decommission --enforce counts C. splunk offline --enforce-counts D. splunk offline -f

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

When should a Universal Forwarder be used instead of a Heavy Forwarder?

A. When data comes directly from a database server. B. When most of the data requires masking. C. When a modular input is needed. D. When there is a high-velocity data source.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 9

Which props.conf setting has the least impact on indexing performance?

A. SHOULD_LINEMERGE B. TRUNCATE C. TIME_PREFIX D. CHARSET

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).