Online Access Free SPLK-2002 Exam Questions

Which of the following is true regarding the migration of an index cluster from single-site to multi-site?

• A.Single-site buckets cannot be converted to multi-site buckets.
• B.Existing single-site attributes must be removed.
• C.All peer nodes must be running the same version of Splunk.
• D.Multi-site policies will apply to all data in the indexer cluster.

Which Splunk internal index contains license-related events?

• A._license
• B._internal
• C._audit
• D._introspection

Which of the following is a best practice to maximize indexing performance?

• A.Use the Splunk default settings.
• B.Use automatic source typing.
• C.Minimize configuration generality.
• D.Not use pre-trained source types.

Which of the following most improves KV Store resiliency?

• A.Add faster storage to the search heads to improve artifact replication.
• B.Decrease latency between search heads.
• C.Increase the size of the Operations Log.
• D.Add indexer CPU and memory to decrease search latency.

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

• A.Decrease the maximum size of the search pipelines in limits.conf
• B.Increase the maximum number of hot buckets in indexes.conf
• C.Increase the number of parallel ingestion pipelines in server.conf
• D.Decrease the maximum concurrent scheduled searches in limits.conf