Get Special Discount Offer of SPLK-2002 Certification Exam Sample Questions and Answers [Q96-Q114]

QUESTION 96
What is the expected minimum amount of storage required for data across an indexer cluster with the following input and parameters?
* Raw data = 15 GB per day
* Index files = 35 GB per day
* Replication Factor (RF) = 2
* Search Factor (SF) = 2

QUESTION 97
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

QUESTION 98
Which of the following can a Splunk diagcontain?

QUESTION 99
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspectionindex. Which of the following logs are included in this index? (Select all that apply.)

QUESTION 100
Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

QUESTION 101
How can internal logging levels in a Splunk environment be changed to troubleshoot an issue? (select all that apply)

QUESTION 102
What is the default log size for Splunk internal logs?

QUESTION 103
In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

QUESTION 104
Which of the following should be included in a deployment plan?

QUESTION 105
When should multiple search pipelines be enabled?

QUESTION 106
How does the average run time of all searches relate to the available CPU cores on the indexers?

QUESTION 107
Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

QUESTION 108
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

QUESTION 109
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspection index. Which of the following logs are included in this index? (Select all that apply.)

QUESTION 110
Which of the following statements describe search head clustering? (Select all that apply.)

QUESTION 111
A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

QUESTION 112
Which of the following statements describe search head clustering? (Select all that apply.)

QUESTION 113
Which of the following artifacts are included in a Splunk diagfile? (Select all that apply.)

QUESTION 114
Users are asking the Splunk administrator to thaw recently-frozen buckets very frequently. What could the Splunk administrator do to reduce the need to thaw buckets?