Question 1

A three-node search head cluster is skipping a large number of searches across time. What should be done to

increase scheduled search capacity on the search head cluster?

Options :

A : Create a job server on the cluster.

B : Add another search head to the cluster.

C : server.conf captain_is_adhoc_searchhead = true.

D : Change limits.conf value for max_searches_per_cpu to a higher value.

Answer: D

Question 2

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Options :

A : Disables search site affinity.

B : Sets all members to dynamic captaincy.

C : Enables multisite search artifact replication.

D : Enables automatic search site affinity discovery.

Answer: A

Question 3

Which Splunk Enterprise offering has its own license?

Options :

A : Splunk Cloud Forwarder

B : Splunk Heavy Forwarder

C :

Splunk Universal Forwarder

D : Splunk Forwarder Management

Answer: C

Question 4

What is a Splunk Job? (Select all that apply.)

Options :

A :

A user-defined Splunk capability.

B :

Searches that are subjected to some usage quota.

C : A search process kicked off via a report or an alert.

D : A child OS process manifested from the splunkd process.

Answer: A

Question 5

What is the logical first step when starting a deployment plan?

Options :

A : Inventory the currently deployed logging infrastructure.

B : Determine what apps and use cases will be implemented.

C : Gather statistics on the expected adoption of Splunk for sizing.

D : Collect the initial requirements for the deployment from all stakeholders.

Answer: D

Higher Test Marks with Free Online SPLK-2002 Exam Practice