SPLK-2002 Practice Test

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspection index. Which of the following logs are included in this index? (Select all that apply.)

A.

audit.log

B.

metrics.log

C.

disk_objects.log

D.

resource_usage.log

Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

A.

Is the job scheduler for the entire SHC.

B.

Manages alert action suppressions (throttling).

C.

Synchronizes the member list with the KV store primary.

D.

Replicates the SHC's knowledge bundle to the search peers.

In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

A.

Input

B.

Search

C.

Parsing

D.

Indexing

The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

A.

rawdata is: 10%, tsidx is: 40%

B.

rawdata is: 15%, tsidx is: 35%

C.

rawdata is: 35%, tsidx is: 15%

D.

rawdata is: 40%, tsidx is: 10%

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

A.

ITSI requires a dedicated deployment server.

B.

The amount of users using ITSI will not impact performance.

C.

ITSI in a Splunk deployment does not require additional hardware resources.

D.

Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be
needed.