Free Splunk SPLK-2002 Exam Dumps Questions & Answers

Which props.conf setting has the least impact on indexing performance?

• A.  TIME_PREFIX
• B.  TRUNCATE
• C.  CHARSET
• D.  SHOULD_LINEMERGE

Which of the following use cases would be made possible by multi-site clustering? (select all that apply)

• A.  Use blockchain technology to audit search activity from geographically dispersed data centers.
• B.  Greatly reduce WAN traffic by preferentially searching assigned site (search affinity).
• C.  Seamlessly route searches to a redundant site in case of a site failure.
• D.  Enable a forwarder to send data to multiple indexers.

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

• A.  Two indexers clustered, assuming high availability is the greatest priority.
• B.  Three indexers not in a cluster, assuming a long data retention period.
• C.  Two indexers not in a cluster, assuming users run many long searches.
• D.  Two indexers clustered, assuming a high volume of saved/scheduled searches.

Which of the following strongly impacts storage sizing requirements for Enterprise Security?

• A.  The number of Splunk users configured.
• B.  The number of scheduled (correlation) searches.
• C.  The number of Data Models accelerated.
• D.  The number of source types used in the environment.

Which of the following server. conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?

• A. 
• B. 
• C. 
• D.