Question 1

A three-node search head cluster is skipping a large number of searches across time. What should be done to

increase scheduled search capacity on the search head cluster?

Options :

A : Create a job server on the cluster.

B : Add another search head to the cluster.

C : server.conf captain_is_adhoc_searchhead = true.

D : Change limits.conf value for max_searches_per_cpu to a higher value.

Answer: D

Question 2

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor

has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

Options :

A : Identify number of scheduled or real-time searches.

B : Validate if this Technical Add-On enables event data for a data model.

C : Identify the maximum number of forwarders Technical Add-On can support.

D : Verify if Technical Add-On needs to be installed onto both a search head or indexer.

Answer: A,C

Question 3

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

Options :

A :

Distributes apps to SHC members.

B :

Bootstraps a clean Splunk install for a SHC.

C : Distributes non-search related and manual configuration file changes.

D : Distributes runtime knowledge object changes made by users across the SHC.

Answer: A

Question 4

To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

Options :

A : Rolling restart completes.

B : Master node rejoins the cluster.

C : Captain joins or rejoins cluster.

D : A peer node joins or rejoins the cluster.

Answer: A,B,D

Question 5

As of Splunk 9.0, which index records changes to . conf files?

Options :

A : _configtracker

B : _introspection

C : _internal

D : _audit

Answer: A

Smartly Prepare Exam with Free Online SPLK-2002 Practice Test