Question 1

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Options :

A : Disables search site affinity.

B : Sets all members to dynamic captaincy.

C : Enables multisite search artifact replication.

D : Enables automatic search site affinity discovery.

Answer: A

Question 2

Which of the following statements describe search head clustering? (Select all that apply.)

Options :

A : A deployer is required.

B : At least three search heads are needed.

C : Search heads must meet the high-performance reference server requirements.

D : The deployer must have sufficient CPU and network resources to process service requests and push configurations.

Answer: A,C

Question 3

A customer currently has many deployment clients being managed by a single, dedicated deployment server.

The customer plans to double the number of clients.

What could be done to minimize performance issues?

Options :

A : Modify deploymentclient. conf to change from a Pull to Push mechanism.

B : Reduce the number of apps in the Manager Node repository.

C : Increase the current deployment client phone home interval.

D : Decrease the current deployment client phone home interval.

Answer: C

Question 4

Which of the following options in limits, conf may provide performance benefits at the forwarding tier?

Options :

A : Enable the indexed_realtime_use_by_default attribute.

B : Increase the maxKBps attribute.

C : Increase the parallellngestionPipelines attribute.

D : Increase the max_searches per_cpu attribute.

Answer: C

Question 5

A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department. Which of the following items might be the cause for this issue?

Options :

A : The search head may have different configurations than the indexers.

B : The data inputs are not properly configured across all the forwarders.

C : The indexers may have different configurations than the heavy forwarders.

D : The forwarders managed by the other department are an older version than the rest.

Answer: C

Confidently Practice Online with Free SPLK-2002 Exam Cram

Buying Options: