Prepare for your exam certification with our splk-2002 Certified Splunk [Q34-Q52]

Q34. Which Splunk Enterprise offering has its own license?

Q35. When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

Q36. In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

Q37. A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that
field in their search results with events known to have src_ip. Which of the following may explain the
problem? (Select all that apply.)

Q38. Which of the following is an indexer clustering requirement?

Q39. Configurations from the deployer are merged into which location on the search head cluster member?

Q40. In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

Q41. Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

Q42. What is the logical first step when starting a deployment plan?

Q43. A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

Q44. Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspection index. Which of the following logs are included in this index? (Select all that apply.)

Q45. What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

Q46. Which CLI command converts a Splunk instance to a license slave?

Q47. Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspectionindex. Which of the following logs are included in this index? (Select all that apply.)

Q48. Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

Q49. Which of the following commands is used to clear the KV store?

Q50. Which of the following can a Splunk diagcontain?

Q51. A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining
that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web
logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the
forwarders are managed by another department.
Which of the following items might be the cause for this issue?

Q52. Which Splunk server role regulates the functioning of indexer cluster?