QUESTION: 33

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

audit.log
metrics.log
disk_objects.log
resource_usage.log

Answer(s): C,D

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Troubleshooting/Abouttheplatforminstrumentationframework

Reveal Solution Next Question

QUESTION: 34

Which of the following can a Splunk diag contain?

Search history, Splunk users and their roles, running processes, indexed data
Server specs, current open connections, internal Splunk log files, index listings
KV store listings, internal Splunk log files, search peer bundles listings, indexed data
Splunk platform configuration details, Splunk users and their roles, current open connections, index listings

Answer(s): B

Reference:

https://splunkonbigdata.com/2018/10/01/splunk-diag/

Reveal Solution Next Question

QUESTION: 35

Which of the following are true statements about Splunk indexer clustering?

All peer nodes must run exactly the same Splunk version.
The master node must run the same or a later Splunk version than search heads.
The peer nodes must run the same or a later Splunk version than the master node.
The search head must run the same or a later Splunk version than the peer nodes.

Answer(s): B

Reference:

https://answers.splunk.com/answers/760348/search-head-version-compatibility.html

Reveal Solution Next Question

QUESTION: 36

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

Two indexers not in a cluster, assuming users run many long searches.
Three indexers not in a cluster, assuming a long data retention period.
Two indexers clustered, assuming high availability is the greatest priority.
Two indexers clustered, assuming a high volume of saved/scheduled searches.

Answer(s): D

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/Summaryofperformancerecommendations

Reveal Solution Next Question

Splunk Enterprise Certified Architect SPLK-2002 Exam

QUESTION: 33

Reference:

QUESTION: 34

Reference:

QUESTION: 35

Reference:

QUESTION: 36

Reference:

Splunk Enterprise Certified Architect
SPLK-2002 Exam