Free Splunk Enterprise Certified Architect SPLK-2002 Exam Practice Test

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

• adhoc_searchhead = true (on all members)
• adhoc_searchhead = true (on the current captain)
• captain_is_adhoc_searchhead = true (on all members)
• captain_is_adhoc_searchhead = true (on the current captain)

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

• Configure syslog to send the data to multiple Splunk indexers.
• Use a Splunk indexer to collect a network input on port 514 directly.
• Use a Splunk forwarder to collect the input on port 514 and forward the data.
• Configure syslog to write logs and use a Splunk forwarder to collect the logs.

What is the minimum reference server specification for a Splunk indexer?

• 12 CPU cores, 12GB RAM, 800 IOPS
• 16 CPU cores, 16GB RAM, 800 IOPS
• 24 CPU cores, 16GB RAM, 1200 IOPS
• 28 CPU cores, 32GB RAM, 1200 IOPS

Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

• A Hadoop application can search data in Splunk.
• Splunk can search data in the Hadoop File System (HDFS).
• You can use Splunk alerts to provision actions on a third-party system.
• You can forward data from Splunk forwarder to a third-party system without indexing it first.

Which Splunk Enterprise offering has its own license?

• Splunk Cloud Forwarder
• Splunk Heavy Forwarder
• Splunk Universal Forwarder
• Splunk Forwarder Management

Which of the following can a Splunk diag contain?

• Search history, Splunk users and their roles, running processes, indexed data
• Server specs, current open connections, internal Splunk log files, index listings
• KV store listings, internal Splunk log files, search peer bundles listings, indexed data
• Splunk platform configuration details, Splunk users and their roles, current open connections, index listings

Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

• Check serverclass.conf of the deployment server.
• Check deploymentclient.conf of the deployment client.
• Check the content of SPLUNK_HOME/etc/apps of the deployment server.
• Search for relevant events in splunkd.log of the deployment server.

Which of the following is a way to exclude search artifacts when creating a diag?

• SPLUNK_HOME/bin/splunk diag --exclude
• SPLUNK_HOME/bin/splunk diag --debug --refresh
• SPLUNK_HOME/bin/splunk diag --disable=dispatch
• SPLUNK_HOME/bin/splunk diag --filter-searchstrings

When planning a search head cluster, which of the following is true?

• All search heads must use the same operating system.
• All search heads must be members of the cluster (no standalone search heads).
• The search head captain must be assigned to the largest search head in the cluster.
• All indexers must belong to the underlying indexer cluster (no standalone indexers).

The frequency in which a deployment client contacts the deployment server is controlled by what?

• polling_interval attribute in outputs.conf
• phoneHomeIntervalInSecs attribute in outputs.conf
• polling_interval attribute in deploymentclient.conf
• phoneHomeIntervalInSecs attribute in deploymentclient.conf