QUESTION: 37

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

adhoc_searchhead = true (on all members)
adhoc_searchhead = true (on the current captain)
captain_is_adhoc_searchhead = true (on all members)
captain_is_adhoc_searchhead = true (on the current captain)

Answer(s): D

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Adhocclustermember

Reveal Solution Next Question

QUESTION: 38

At which default interval does metrics.log generate a periodic report regarding license utilization?

10 seconds
30 seconds
60 seconds
300 seconds

Answer(s): B

Reference:

https://docs.splunk.com/Documentation/Splunk/7.3.2/Troubleshooting/Aboutmetricslog

Reveal Solution Next Question

QUESTION: 39

Which of the following is a good practice for a search head cluster deployer?

The deployer only distributes configurations to search head cluster members when they “phone home”.
The deployer must be used to distribute non-replicable configurations to search head cluster members.
The deployer must distribute configurations to search head cluster members to be valid configurations.
The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.

Answer(s): A

Reveal Solution Next Question

QUESTION: 40

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

Configure syslog to send the data to multiple Splunk indexers.
Use a Splunk indexer to collect a network input on port 514 directly.
Use a Splunk forwarder to collect the input on port 514 and forward the data.
Configure syslog to write logs and use a Splunk forwarder to collect the logs.

Answer(s): C

Reference:

https://wiki.splunk.com/Community:BestPracticeForConfiguringSyslogInput

Reveal Solution Next Question

Free SPLK-2002 Exam Braindumps (page: 11)

QUESTION: 37

Reference:

QUESTION: 38

Reference:

QUESTION: 39

QUESTION: 40

Reference:

SPLK-2002 Discussions & Posts