SPLK-2002 Practice Test

Which component in the splunkd.log will log information related to bad event breaking?

A.

Audittrail

B.

EventBreaking

C.

IndexingPipeline

D.

AggregatorMiningProcessor

Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

A.

A Hadoop application can search data in Splunk.

B.

Splunk can search data in the Hadoop File System (HDFS).

C.

You can use Splunk alerts to provision actions on a third-party system.

D.

You can forward data from Splunk forwarder to a third-party system without indexing it first.

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they
also want high data availability and high search performance. The customer is concerned about cost and wants
to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

A.

Two indexers not in a cluster, assuming users run many long searches

C.

Three indexers not in a cluster, assuming a long data retention period.

D.

Two indexers clustered, assuming high availability is the greatest priority.

E.

Two indexers clustered, assuming a high volume of saved/scheduled searches

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

A.

telnet

B.

tcpdump

C.

splunk btool

D.

splunk btprobe

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the
SHOULD_LINEMERGE attribute should be set to what?

A.

Auto

B.

None

C.

True

D.

False