A peer in a Splunk indexer cluster has been down for several hours. The administrator suspects the peer will not recover. What is the recommended manual procedure to recover the cluster to a healthy state?

Increase the replication factor to compensate for the failed peer.

Manually copy the failed peer's buckets to other peers using the CLI.

Remove the peer from the cluster using the master's CLI, then allow the master to rebalance the remaining peers.

Restart the master to force the cluster to rebalance.

How does the master detect that a peer is down in an indexer cluster?

It receives a notification from the peer's monitoring console.

It expects to receive heartbeats from the peer at regular intervals and marks it down after a timeout.

It sends a ping to the peer and waits for a response.

It checks the peer's status via a REST API call.

A peer in a Splunk indexer cluster fails permanently. The administrator has removed the peer from the cluster. What is the next step the cluster will take to restore replication and search factors?

The administrator must manually copy the failed peer's buckets to other peers using the CLI.

The cluster will continue to operate in a degraded state until a new peer is added to replace the failed one.

The master will delete the failed peer's buckets from the cluster to free up space.

The master will automatically rebalance buckets from the failed peer to the remaining peers, prioritizing buckets that are below the replication factor.

A Splunk indexer cluster has 8 peers, replication_factor=3, search_factor=2. The master is experiencing intermittent network issues, causing some peers to miss heartbeats. The administrator notices that the cluster is frequently entering a degraded state, but no peers are actually down. What is the best solution to reduce false positives while maintaining accurate failure detection?

Increase the heartbeat timeout on the master to accommodate network latency.

Add more peers to the cluster to reduce the impact of false positives.

Disable heartbeats and rely on manual monitoring.

Decrease the heartbeat timeout to detect failures faster.

What does the 'degraded' cluster state indicate?

The cluster is in the process of initializing and has not yet become ready.

The master is down and the cluster is operating without management.

One or more peers are down or replication/search factors are not met.

The cluster is fully operational and all factors are met.

SplunkCore Certified Consultant

Domain 8Objective 3

Determine Failure Modes and Recovery Processes CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Part of the Indexer Clustering domain, which accounts for 18% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

7concepts

18%of the exam

Questions 6–10

6application · medium
A peer in a Splunk indexer cluster has been down for several hours. The administrator suspects the peer will not recover. What is the recommended manual procedure to recover the cluster to a healthy state?
Select an answer first
7foundation · easy
How does the master detect that a peer is down in an indexer cluster?
Select an answer first
8application · medium
A peer in a Splunk indexer cluster fails permanently. The administrator has removed the peer from the cluster. What is the next step the cluster will take to restore replication and search factors?
Select an answer first
9expert · hard
A Splunk indexer cluster has 8 peers, replication_factor=3, search_factor=2. The master is experiencing intermittent network issues, causing some peers to miss heartbeats. The administrator notices that the cluster is frequently entering a degraded state, but no peers are actually down. What is the best solution to reduce false positives while maintaining accurate failure detection?
Select an answer first
10foundation · easy
What does the 'degraded' cluster state indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.