Splunk
SPLK-2002
Q1:
What is a Splunk Job? (Select all that apply.)
○
A
A user-defined Splunk capability.○
B
Searches that are subjected to some usage quota.○
C
A search process kicked off via a report or an alert.○
D
A child OS process manifested from the splunkd process.
Splunk
SPLK-2002
Q2:
Which of the following describe migration from single-site to multisite index replication?
○
A
A master node is required at each site.○
B
Multisite policies apply to new data only.○
C
Single-site buckets instantly receive the multisite policies.○
D
Multisite total values should not exceed any single-site factors.
Splunk
SPLK-2002
Q3:
A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering]
mode = master
replication_factor = 2
pass4SymmKey = password123
Which of the following statements describe this Splunk instance? (Select all that apply.)
☐
A
This is a multi-site cluster.☐
B
This cluster's search factor is 2.☐
C
This Splunk instance needs to be restarted.☐
D
This instance is missing the master_uri attribute.
Splunk
SPLK-2002
Q4:
Which command is used for thawing the archive bucket?
○
A
Splunk collect○
B
Splunk convert○
C
Splunk rebuild○
D
Splunk dbinspect
Splunk
SPLK-2002
Q5:
In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)
☐
A
Use the Monitoring Console.☐
B
Use the Search Head Clustering settings menu from Splunk Web on any member.☐
C
Run the splunk transfer shcluster-captain command from the current captain.☐
D
Run the splunk transfer shcluster-captain command from the member you would like to become the captain.