Isolate Problems Before Contacting Splunk Cloud Support CLOUD-CERTIFIED-ADMIN Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A Splunk Cloud environment is experiencing intermittent search timeouts during peak hours. The admin has reviewed the Monitoring Console and sees that CPU utilization on the search heads is consistently above 90% during those times. The admin also notices that several scheduled searches are running concurrently. What is the best course of action to isolate the problem before contacting support?

   • AIncrease the search timeout setting to allow searches to complete.
   • BReview the scheduled searches to identify any that are resource-intensive and consider staggering their schedules.
   • CContact support immediately to request additional search head capacity.
   • DDisable all scheduled searches to reduce CPU usage.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is migrating from on-premises Splunk to Splunk Cloud. After migration, a user reports that a search that worked on-premises returns no results in the cloud. The admin has verified that the data is being indexed in the cloud. What is the most likely cause to investigate first?

   • AThe data is not being indexed because of a licensing issue.
   • BThe search head in the cloud is not powerful enough to run the search.
   • CThe search might be referencing an index or sourcetype that is not present in the cloud environment.
   • DThe user does not have permission to run searches in the cloud.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An admin is troubleshooting why a search returns no results for a known sourcetype. The admin has confirmed that data is being indexed by running a metadata search. What should the admin do next to isolate the problem?

   • ACheck the props.conf for the sourcetype to ensure time extraction is correct.
   • BContact support with the metadata search results.
   • CRestart the search head to clear any cached search results.
   • DReview the search logs and any error messages in the _internal index.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An admin has isolated a problem to a specific search that is failing with an error message. Before contacting support, which information should the admin include in the problem summary?

   • AThe number of users affected by the issue.
   • BThe IP address of the user's workstation.
   • CThe exact search string, the error message, and the time range of the search.
   • DThe admin's guess about the cause of the error.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When troubleshooting a missing data issue, which of the following is the most direct way to verify that a data input is functioning?

   • ARun a search for the input's source or sourcetype and check for recent events
   • BVerify that the input is enabled in the Data Inputs page
   • CCheck the input's configuration for correct sourcetype and index settings
   • DReview the Splunk Cloud audit logs for input-related errors
   Reveal Solution Discussion Select an answer first