Question 1

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

Options :

A : Free licenses do not support clustering.

B : Replicated data does not count against licensing.

C : Each cluster member requires its own clustering license.

D : Cluster members must share the same license pool and license master.

Answer: B,D

Question 2

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

Options :

A : The field was extracted as a private knowledge object.

B : The events are tagged as communicate, but are missing the network tag.

C : The Typing Queue, which does regular expression replacements, is blocked.

D : The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Answer: D

Question 3

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select

all that apply.)

Options :

A : telnet

B : tcpdump

C :

splunk btool

D :

splunk btprobe

Answer: B,C

Question 4

What is a Splunk Job? (Select all that apply.)

Options :

A :

A user-defined Splunk capability.

B :

Searches that are subjected to some usage quota.

C : A search process kicked off via a report or an alert.

D : A child OS process manifested from the splunkd process.

Answer: A

Question 5

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Options :

A : Increasing the search factor in the cluster.

B : Increasing the replication factor in the cluster.

C : Increasing the number of search heads in the cluster.

D : Increasing the number of CPUs on the indexers in the cluster.

Answer: B

Free SPLK-2002 Mock Exam – Practice Online Confidently

Buying Options: