Splunk SPLK-2002 - Splunk Enterprise Certified Architect Exam
Page: 2 / 35
Total 172 questions
Question #6 (Topic: Single Topic)
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
A. Distributes apps to SHC members.
B. Bootstraps a clean Splunk install for a SHC.
C. Distributes non-search related and manual configuration file changes.
D. Distributes runtime knowledge object changes made by users across the SHC.
Answer: A
Question #7 (Topic: Single Topic)
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?
A. Auto
B. None
C. True
D. False
Answer: D
Question #8 (Topic: Single Topic)
Which of the following should be included in a deployment plan?
A. Business continuity and disaster recovery plans.
B. Current logging details and data source inventory.
C. Current and future topology diagrams of the IT environment.
D. A comprehensive list of stakeholders, either direct or indirect.
Answer: B
Question #9 (Topic: Single Topic)
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
A. Via Splunk Web.
B. Directly edit SPLUNK_HOME/etc/system/local/server.conf
C. Run a splunk edit cluster-config command from the CLI.
D. Directly edit SPLUNK_HOME/etc/system/default/server.conf
Answer: BC
Question #10 (Topic: Single Topic)
Which index-time props.conf attributes impact indexing performance? (Select all that apply.)
A. REPORT
B. LINE_BREAKER
C. ANNOTATE_PUNCT
D. SHOULD_LINEMERGE
Answer: BC
