Question 1

Which of the following options in limits, conf may provide performance benefits at the forwarding tier?

Options :

A : Enable the indexed_realtime_use_by_default attribute.

B : Increase the maxKBps attribute.

C : Increase the parallellngestionPipelines attribute.

D : Increase the max_searches per_cpu attribute.

Answer: C

Question 2

What is the expected minimum amount of storage required for data across an indexer cluster with the

following input and parameters?

• Raw data = 15 GB per day

• Index files = 35 GB per day

• Replication Factor (RF) = 2

• Search Factor (SF) = 2

Options :

A : 85 GB per day

B : 50 GB per day

C : 100 GB per day

D : 65 GB per day

Answer: C

Question 3

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

Options :

A : The field was extracted as a private knowledge object.

B : The events are tagged as communicate, but are missing the network tag.

C : The Typing Queue, which does regular expression replacements, is blocked.

D : The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Answer: D

Question 4

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the

SHOULD_LINEMERGE attribute should be set to what?

Options :

A : Auto

B : None

C : True

D : False

Answer: C

Question 5

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

Options :

A :

Distributes apps to SHC members.

B :

Bootstraps a clean Splunk install for a SHC.

C : Distributes non-search related and manual configuration file changes.

D : Distributes runtime knowledge object changes made by users across the SHC.

Answer: A

Free SPLK-2002 Mock Exam – Practice Online Confidently

Buying Options: