Question 1

What is the expected minimum amount of storage required for data across an indexer cluster with the

following input and parameters?

• Raw data = 15 GB per day

• Index files = 35 GB per day

• Replication Factor (RF) = 2

• Search Factor (SF) = 2

Options :

A : 85 GB per day

B : 50 GB per day

C : 100 GB per day

D : 65 GB per day

Answer: C

Question 2

Which Splunk Enterprise offering has its own license?

Options :

A : Splunk Cloud Forwarder

B : Splunk Heavy Forwarder

C :

Splunk Universal Forwarder

D : Splunk Forwarder Management

Answer: C

Question 3

A customer currently has many deployment clients being managed by a single, dedicated deployment server.

The customer plans to double the number of clients.

What could be done to minimize performance issues?

Options :

A : Modify deploymentclient. conf to change from a Pull to Push mechanism.

B : Reduce the number of apps in the Manager Node repository.

C : Increase the current deployment client phone home interval.

D : Decrease the current deployment client phone home interval.

Answer: C

Question 4

What is a Splunk Job? (Select all that apply.)

Options :

A :

A user-defined Splunk capability.

B :

Searches that are subjected to some usage quota.

C : A search process kicked off via a report or an alert.

D : A child OS process manifested from the splunkd process.

Answer: A

Question 5

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

Options :

A : Free licenses do not support clustering.

B : Replicated data does not count against licensing.

C : Each cluster member requires its own clustering license.

D : Cluster members must share the same license pool and license master.

Answer: B,D

Free SPLK-2002 Mock Exam – Practice Online Confidently

Buying Options: