更新されたのは2023年02月は100%カバー率でSPLK-2002リアルな試験問題で100%合格保証
実際問題を使おうSplunk問題集で100%無料で使えるSPLK-2002試験問題集
質問 31
In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?
- A. Total daily indexing volume, number of peer nodes, replication factor, and search factor.
- B. Total daily indexing volume, number of peer nodes, and number of accelerated searches.
- C. Total daily indexing volume, replication factor, search factor, and number of search heads.
- D. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.
正解: D
質問 32
Which of the following describe migration from single-site to multisite index replication?
- A. A master node is required at each site.
- B. Multisite policies apply to new data only.
- C. Single-site buckets instantly receive the multisite policies.
- D. Multisite total values should not exceed any single-site factors.
正解: D
質問 33
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.
Which of the following items might be the cause for this issue?
- A. The data inputs are not properly configured across all the forwarders.
- B. The indexers may have different configurations than the heavy forwarders.
- C. The search head may have different configurations than the indexers.
- D. The forwarders managed by the other department are an older version than the rest.
正解: D
質問 34
As a best practice, where should the internal licensing logs be stored?
- A. Search head layer.
- B. License server.
- C. Deployment layer.
- D. Indexing layer.
正解: A
解説:
Explanation/Reference: https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan
質問 35
Which of the following are client filters available in serverclass.conf? (Select all that apply.)
- A. Platform (machine type).
- B. Splunk server role.
- C. DNS name.
- D. IP address.
正解: C,D
質問 36
When troubleshooting monitor inputs, which command checks the status of the tailed files?
splunk cmd btool inputs list | tail
- A. curl https://serverhost:8089/services/admin/inputstatus/
- B. TailingProcessor:FileStatus
curl https://serverhost:8089/services/admin/inputstatus/ - C. splunk cmd btool check inputs layer
- D. TailingProcessor:Tailstatus
正解: B
解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/ Troubleshoottheinputprocess#Troubleshoot_your_tailed_files
質問 37
When using the props.conf LINE_BREAKERattribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?
- A. None
- B. True
- C. Auto
- D. False
正解: B
解説:
Explanation/Reference: https://answers.splunk.com/answers/6926/how-to-keep-data-together-as-one-event.html
質問 38
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that
field in their search results with events known to have src_ip. Which of the following may explain the
problem? (Select all that apply.)
- A. The field was extracted as a private knowledge object.
- B. The events are tagged as communicate, but are missing the network tag.
- C. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.
- D. The Typing Queue, which does regular expression replacements, is blocked.
正解: C
解説:
Explanation/Reference: https://answers.splunk.com/answers/657187/map-command-field-not-being-evaluated.html
質問 39
A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?
- A. Two indexers clustered, assuming a high volume of saved/scheduled searches.
- B. Two indexers clustered, assuming high availability is the greatest priority.
- C. Three indexers not in a cluster, assuming a long data retention period.
- D. Two indexers not in a cluster, assuming users run many long searches.
正解: B
解説:
Explanation
https://docs.splunk.com/Documentation/Splunk/8.1.0/DistSearch/Distsearchsystemrequirements
質問 40
At which default interval does metrics.loggenerate a periodic report regarding license utilization?
- A. 300 seconds
- B. 60 seconds
- C. 10 seconds
- D. 30 seconds
正解: D
解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Troubleshooting/Aboutmetricslog
質問 41
When Splunk indexes data in a non clustered environment, what kind of files does it create by default?
- A. Index and .tsidx files.
- B. Compressed and meta data files.
- C. Compressed and .tsidx files.
- D. Rawdata and index files.
正解: D
解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Aboutindexesandindexers
質問 42
Which of the following should be included in a deployment plan?
- A. Current logging details and data source inventory.
- B. Current and future topology diagrams of the IT environment.
- C. Business continuity and disaster recovery plans.
- D. A comprehensive list of stakeholders, either direct or indirect.
正解: D
解説:
Explanation/Reference: https://docs.splunk.com/Documentation/CoE/ssf/Handbook/StakeholderReg
質問 43
Which command is used for thawing the archive bucket?
- A. Splunk rebuild
- B. Splunk dbinspect
- C. Splunk collect
- D. Splunk convert
正解: A
解説:
Explanation/Reference: https://answers.splunk.com/answers/337025/after-frozen-data-restore-thawed-data-not- working.html
質問 44
When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?
- A. 1. Delete Splunk Enterprise, if it exists.
2. Install and initialize the instance.
3. Join the SHC. - B. 1. Initialize cluster rebalance operation.
2. Remove master node from cluster.
3. Trigger replication. - C. 1. Install and initialize the instance.
2. Delete Splunk Enterprise, if it exists.
3. Join the SHC. - D. 1. Trigger replication.
2. Remove master node from cluster.
3. Initialize cluster rebalance operation.
正解: C
解説:
Explanation
質問 45
Which component in the splunkd.logwill log information related to bad event breaking?
- A. Audittrail
- B. EventBreaking
- C. IndexingPipeline
- D. AggregatorMiningProcessor
正解: D
解説:
Explanation/Reference: https://answers.splunk.com/answers/141721/error-in-splunkd-log-breaking-event-because-limit-of-
256-has-been-exceeded.html
質問 46
Which Splunk server role regulates the functioning of indexer cluster?
- A. Monitoring Console
- B. Indexer
- C. Deployer
- D. Master Node
正解: D
質問 47
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
- A. Distributes non-search related and manual configuration file changes.
- B. Bootstraps a clean Splunk install for a SHC.
- C. Distributes apps to SHC members.
- D. Distributes runtime knowledge object changes made by users across the SHC.
正解: A,C
質問 48
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspection index. Which of the following logs are included in this index? (Select all that apply.)
- A. metrics.log
- B. resource_usage.log
- C. disk_objects.log
- D. audit.log
正解: B,C
質問 49
Which of the following statements describe search head clustering? (Select all that apply.)
- A. At least three search heads are needed.
- B. The deployer must have sufficient CPU and network resources to process service requests and push configurations.
- C. Search heads must meet the high-performance reference server requirements.
- D. A deployer is required.
正解: C,D
質問 50
What is the default log size for Splunk internal logs?
- A. 25MB
- B. 30MB
- C. 20 MB
- D. 10MB
正解: A
解説:
Explanation/Reference: https://answers.splunk.com/answers/959/how-can-i-control-the-size-and-number-of-splunks- internal-logs.html
質問 51
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)
- A. metrics.log
- B. resource_usage.log
- C. disk_objects.log
- D. audit.log
正解: B,C
質問 52
......
SPLK-2002問題集PDFでSPLK-2002リアル試験問題解答：https://jp.fast2test.com/SPLK-2002-premium-file.html
実際に出るSPLK-2002最新の問題集練習テスト問題集：https://drive.google.com/open?id=1-mi20LbTmUNkeTrTNDMModtwz8vjyqd0