Question 1

As of Splunk 9.0, which index records changes to . conf files?

Options :

A : _configtracker

B : _introspection

C : _internal

D : _audit

Answer: A

Question 2

What is the expected minimum amount of storage required for data across an indexer cluster with the

following input and parameters?

• Raw data = 15 GB per day

• Index files = 35 GB per day

• Replication Factor (RF) = 2

• Search Factor (SF) = 2

Options :

A : 85 GB per day

B : 50 GB per day

C : 100 GB per day

D : 65 GB per day

Answer: C

Question 3

Which of the following options in limits, conf may provide performance benefits at the forwarding tier?

Options :

A : Enable the indexed_realtime_use_by_default attribute.

B : Increase the maxKBps attribute.

C : Increase the parallellngestionPipelines attribute.

D : Increase the max_searches per_cpu attribute.

Answer: C

Question 4

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Options :

A : Disables search site affinity.

B : Sets all members to dynamic captaincy.

C : Enables multisite search artifact replication.

D : Enables automatic search site affinity discovery.

Answer: A

Question 5

Configurations from the deployer are merged into which location on the search head cluster member?

Options :

A : SPLUNK_HOME/etc/system/local

B : SPLUNK_HOME/etc/apps/APP_HOME/local

C : SPLUNK_HOME/etc/apps/search/default

D : SPLUNK_HOME/etc/apps/APP_HOME/default

Answer: A

Higher Test Marks with Free Online SPLK-2002 Exam Practice