SPLK-3003 Practice Test

B.   1. Install new indexers.
2.Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers.
3.Decommission old peers one at a time.
4.Remove old peers from the CM’s list.
5.Update forwarders to forward to the new peers.

Explanation: The correct process and procedure for migrating a Splunk index cluster to new hardware is as follows:
Install new indexers. This step involves installing the Splunk Enterprise software on the new machines and configuring them with the same network settings, OS settings, and hardware specifications as the original indexers.
Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers. This step involves joining the new indexers to the existing cluster as peer nodes, using the same cluster master and replication factor. The new indexers should also receive the same configuration files as the original peers, either by copying them manually or by using a deployment server. The cluster bundle contains the indexes.conf file and other files that define the index settings and data retention policies for the cluster.
Decommission old peers one at a time. This step involves removing the old indexers from the cluster gracefully, using the splunk offline command or the REST API endpoint /services/cluster/master/control/control/decommission. This ensures that the cluster master redistributes the primary buckets from the old peers to the new peers, and that no data is lost during the migration process.
Remove old peers from the CM’s list. This step involves deleting the old indexers from the list of peer nodes maintained by the cluster master, using the splunk remove server command or the REST API endpoint /services/cluster/master/peers. This ensures that the cluster master does not try to communicate with the old peers or assign them any search or replication tasks.
Update forwarders to forward to the new peers. This step involves updating the outputs.conf file on the forwarders that send data to the cluster, so that they point to the new indexers instead of the old ones. This ensures that the data ingestion process is not disrupted by the migration.

C.   Subsearches have a default result output limit of 10000.

Explanation: Subsearches have a default result output limit of 10000. This means that a subsearch can return up to 10000 results to the main search. If the subsearch returns more than 10000 results, the main search will only use the first 10000 results and ignore the rest. This limit can be changed by using the maxout parameter of the format command or by setting the max_subsearch_results option in limits.conf.

B.   Parsing

Explanation: The queue that would be expected to fill up in a worst case scenario when the indexers are struggling to maintain the expected indexing rate due to inefficient regex replacement transforms is the parsing queue. The parsing queue is the queue that holds the events that are being parsed by the indexers. Parsing is the process of extracting fields, timestamps, and other metadata from the raw data. Regex replacement transforms are part of the parsing process, and they can be very CPU-intensive if they are not optimized. Therefore, if the indexers are overloaded with inefficient regex replacement transforms, the parsing queue will fill up faster than it can be emptied, and the indexing rate will suffer. Therefore, the correct answer is B. Parsing.

D.   Splunk will error as it does not support overlapping usernames

Explanation: Splunk does not support overlapping usernames between internal Splunk authentication and LDAP. If a username exists in both $SPLUNK_HOME/etc/passwd and LDAP, Splunk will try to use the internal Splunk authentication first, as explained in the previous question. However, if the user tries to change their password or edit their account settings, Splunk will error with a message like "Cannot edit user: User exists in multiple realms". This is because Splunk cannot determine which authentication scheme to use for these actions. Therefore, it is recommended to avoid overlapping usernames between internal Splunk authentication and LDAP.

C.   Update the Splunk PS base config license app and copy to each indexer.

Explanation: The next step after the customer provides the name of the license master is to update the Splunk PS base config license app and copy it to each indexer. The Splunk PS base config license app is a Splunk app that contains the configuration files for licensing, such as server.conf and licenses.conf. The app needs to be updated with the name of the license master in the server.conf file under the [license] stanza. Then, the app needs to be copied to each indexer in the cluster under $SPLUNK_HOME/etc/apps directory. This will enable the indexers to communicate with the license master and join the license pool. Therefore, the correct answer is C, update the Splunk PS base config license app and copy it to each indexer.