Question 1

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

Options :

A : Free licenses do not support clustering.

B : Replicated data does not count against licensing.

C : Each cluster member requires its own clustering license.

D : Cluster members must share the same license pool and license master.

Answer: B,D

Question 2

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Options :

A : Increasing the search factor in the cluster.

B : Increasing the replication factor in the cluster.

C : Increasing the number of search heads in the cluster.

D : Increasing the number of CPUs on the indexers in the cluster.

Answer: B

Question 3

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

Options :

A : The field was extracted as a private knowledge object.

B : The events are tagged as communicate, but are missing the network tag.

C : The Typing Queue, which does regular expression replacements, is blocked.

D : The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Answer: D

Question 4

Which Splunk Enterprise offering has its own license?

Options :

A : Splunk Cloud Forwarder

B : Splunk Heavy Forwarder

C :

Splunk Universal Forwarder

D : Splunk Forwarder Management

Answer: C

Question 5

What is the expected minimum amount of storage required for data across an indexer cluster with the

following input and parameters?

• Raw data = 15 GB per day

• Index files = 35 GB per day

• Replication Factor (RF) = 2

• Search Factor (SF) = 2

Options :

A : 85 GB per day

B : 50 GB per day

C : 100 GB per day

D : 65 GB per day

Answer: C