Microsoft
Amazon
CompTIA
Salesforce
Cisco®
SAP
PMI
ISC
ISACA
VMware
HP
Palo Alto Networks
EC-Council
LPI
Google
Fortinet
All Vendors
  2. Home
  3. Exam List
  4. Splunk®
  5. SPLK-2002

Splunk Enterprise Certified Architect
SPLK-2002 Exam

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

  1. Increase the maximum number of hot buckets in indexes.conf
  2. Increase the number of parallel ingestion pipelines in server.conf
  3. Decrease the maximum size of the search pipelines in limits.conf
  4. Decrease the maximum concurrent scheduled searches in limits.conf

Answer(s): D



The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

  1. rawdata is: 10%, tsidx is: 40%
  2. rawdata is: 15%, tsidx is: 35%
  3. rawdata is: 35%, tsidx is: 15%
  4. rawdata is: 40%, tsidx is: 10%

Answer(s): B


Reference:

https://answers.splunk.com/answers/147951/what-is-the-compression-ratio-of-raw-data-in-splunk.html



In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files. What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

  1. Total daily indexing volume, number of peer nodes, and number of accelerated searches.
  2. Total daily indexing volume, number of peer nodes, replication factor, and search factor.
  3. Total daily indexing volume, replication factor, search factor, and number of search heads.
  4. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.

Answer(s): D



A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

  1. Create a job server on the cluster.
  2. Add another search head to the cluster.
  3. server.conf captain_is_adhoc_searchhead = true.
  4. Change limits.conf value for max_searches_per_cpu to a higher value.

Answer(s): D




Bila
Thanks! I passed 070-284 with 880 070-219 next to complete my MCSE.
- Colorado
Upvote


Passed
I just took my Certification testing for 10-184 Microsoft CRM Installation and Configuration. Your test questions definitely covered the essence of the exam material and I easily passed the exam.
- UNITED STATES
Upvote


Ed
I passed the IBM exam successfully
- UNITED STATES
Upvote


Tina
Last week I took the Citrix exam and I passed with a very high mark, more than what I expected. Thanks!!
- Israel
Upvote


Calvin B.
I just took my Certification testing for 10-184 Microsoft CRM Installation and Configuration. Your test questions definitely covered the essence of the exam material and I easily passed the exam.
- Lafayette
Upvote


950+
I just finished my exam this week. It was a good score of 950+.
- UNITED STATES
Upvote


Abdul
I passed the exam on Monday morning and was amazed at how much this site had covered, fortunately that's it for another three years. The tests really did help so thanks!!
- Doha
Upvote


Rose
I passed that exam the first time. And I thank you folks for that. I could not have passed it with out your help.
- South Africa
Upvote


Shourya
I've just done my exam and passed (890) - your materials are spot on.
- UNITED STATES
Upvote


90%
I have sat and passed.
- Haidarabad
Upvote

Read more ...