A customer’s deployment server is overwhelmed with forwarder connections after adding an additional 1000 clients. The default phone home interval is set to 60 seconds. To reduce the number of connection failures to the DS what is recommended? A. Create a tiered deployment server topology. B. Reduce the phone home interval to 6 seconds. C. […]

A customer has downloaded the Splunk App for AWS from Splunkbase and installed it in a search head cluster following the instructions using the deployer. A power user modifies a dashboard in the app on one of the search head cluster members. The app containing an updated dashboard is upgraded to the latest version by […]

In a single indexer cluster, where should the Monitoring Console (MC) be installed? A. Deployer sharing with master cluster. B. License master that has 50 clients or more. C. Cluster master node D. Production Search Head Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/DMC/WheretohostDMC

What is the primary driver behind implementing indexer clustering in a customer’s environment? A. To improve resiliency as the search load increases. B. To reduce indexing latency. C. To scale out a Splunk environment to offer higher performance capability. D. To provide higher availability for buckets of data. Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Howclusteredsearchworks

The customer has an indexer cluster supporting a wide variety of search needs, including scheduled search, data model acceleration, and summary indexing. Here is an excerpt from the cluster mater’s server.conf: Which strategy represents the minimum and least disruptive change necessary to protect the searchability of the indexer cluster in case of indexer failure? A. […]

A customer has been using Splunk for one year, utilizing a single/all-in-one instance. This single Splunk server is now struggling to cope with the daily ingest rate. Also, Splunk has become a vital system in day-to-day operations making high availability a consideration for the Splunk service. The customer is unsure how to design the new […]

Which statement is true about subsearches? A. Subsearches are faster than other types of searches. B. Subsearches work best for joining two large result sets. C. Subsearches run at the same time as their outer search. D. Subsearches work best for small result sets. Reference: https://community.splunk.com/t5/Archive/Looking-for-way-to-explain-why-subsearches-are-so-slow/m-p/479133

What should be considered when running the following CLI commands with a goal of accelerating an index cluster migration to new hardware? A. Data ingestion rate B. Network latency and storage IOPS C. Distance and location D. SSL data encryption

Monitoring Console (MC) health check configuration items are stored in which configuration file? A. healthcheck.conf B. alert_actions.conf C. distsearch.conf D. checklist.conf Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/DMC/Customizehealthcheck

A customer has asked for a five-node search head cluster (SHC), but does not have the storage budget to use a replication factor greater than 2. They would like to understand what might happen in terms of the users’ ability to view historic scheduled search results if they log onto a search head which doesn’t […]