A search head cluster has 5 members. The captain is SHC1. The administrator notices that SHC1 is experiencing high CPU usage and suspects it is affecting search performance. They want to move captaincy to SHC2. However, SHC2 is currently in a 'Manual' maintenance mode. What is the best course of action?

Transfer captaincy to SHC3 instead, as SHC2 is unavailable.

Reboot SHC1 to reduce CPU usage and keep it as captain.

Take SHC2 out of maintenance mode, then manually transfer captaincy to SHC2.

Transfer captaincy to SHC2 anyway, as maintenance mode does not affect captaincy.

After an automatic captaincy transfer, an administrator runs `splunk show shcluster-status` and sees that the captain field is empty. What does this indicate?

The administrator does not have permission to view the captain.

The cluster has been permanently disabled.

The cluster is in a split-brain state.

The cluster is still in the process of electing a new captain.

A search head cluster has 5 members. The captain is SHC1. The administrator needs to perform a rolling upgrade of all members. What is the best strategy to minimize downtime and ensure the cluster remains operational?

Upgrade all members simultaneously.

Upgrade the captain first, then upgrade the other members.

Shut down the cluster, upgrade all members, and then restart the cluster.

Upgrade non-captain members first, then manually transfer captaincy to an upgraded member, and finally upgrade the original captain.

How does a captaincy transfer affect the overall operation of a search head cluster?

The cluster becomes read-only until the transfer is complete

The cluster remains operational, but there may be a brief period of reduced coordination during the transfer

All search heads must be restarted after the transfer

The cluster stops accepting new searches until the transfer is complete

What information in the output of 'splunk show shcluster-status' confirms that a captaincy transfer was successful?

The 'captain' field shows the member URI of the intended new captain

The 'active' field shows the number of searches running

The 'status' field shows 'transfer complete'

The 'members' field lists all members in alphabetical order

SplunkEnterprise Certified Architect

Domain 4Objective 4

Captaincy Transfer SPLK-2002 Practice Questions (Page 4)

Part of the Search Head Clustering and KV Store domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

Questions 16–20

16expert · hard
A search head cluster has 5 members. The captain is SHC1. The administrator notices that SHC1 is experiencing high CPU usage and suspects it is affecting search performance. They want to move captaincy to SHC2. However, SHC2 is currently in a 'Manual' maintenance mode. What is the best course of action?
Select an answer first
17application · medium
After an automatic captaincy transfer, an administrator runs `splunk show shcluster-status` and sees that the captain field is empty. What does this indicate?
Select an answer first
18expert · hard
A search head cluster has 5 members. The captain is SHC1. The administrator needs to perform a rolling upgrade of all members. What is the best strategy to minimize downtime and ensure the cluster remains operational?
Select an answer first
19foundation · easy
How does a captaincy transfer affect the overall operation of a search head cluster?
Select an answer first
20foundation · easy
What information in the output of 'splunk show shcluster-status' confirms that a captaincy transfer was successful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.