CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. Splunk®
  5. SPLK-2002

Free SPLK-2002 Exam Braindumps (page: 7)

Page 6 of 23
PDF with 160 Questions

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

  1. Increase the maximum number of hot buckets in indexes.conf
  2. Increase the number of parallel ingestion pipelines in server.conf
  3. Decrease the maximum size of the search pipelines in limits.conf
  4. Decrease the maximum concurrent scheduled searches in limits.conf

Answer(s): D



The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

  1. rawdata is: 10%, tsidx is: 40%
  2. rawdata is: 15%, tsidx is: 35%
  3. rawdata is: 35%, tsidx is: 15%
  4. rawdata is: 40%, tsidx is: 10%

Answer(s): B


Reference:

https://answers.splunk.com/answers/147951/what-is-the-compression-ratio-of-raw-data-in-splunk.html



In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files. What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

  1. Total daily indexing volume, number of peer nodes, and number of accelerated searches.
  2. Total daily indexing volume, number of peer nodes, replication factor, and search factor.
  3. Total daily indexing volume, replication factor, search factor, and number of search heads.
  4. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.

Answer(s): D



A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

  1. Create a job server on the cluster.
  2. Add another search head to the cluster.
  3. server.conf captain_is_adhoc_searchhead = true.
  4. Change limits.conf value for max_searches_per_cpu to a higher value.

Answer(s): D






Post your Comments and Discuss Splunk® SPLK-2002 exam with other Community members:

SPLK-2002 Discussions & Posts