A Splunk administrator is troubleshooting a license violation that occurs only on weekends. The license usage is within the quota on weekdays but exceeds it on Saturdays and Sundays. What is the most likely cause and the appropriate action?

The license master is not reporting usage correctly on weekends; restart the license master.

The indexers are not receiving data on weekends, causing a false violation.

A weekend batch job is indexing a large amount of data; adjust the job's schedule or reduce the data volume.

The license quota is lower on weekends; increase the quota for weekends.

A forwarder is not sending data to the indexer. What is a common corrective action?

Change the search head's authentication method.

Verify network connectivity between the forwarder and indexer.

A user reports that a search returns results that are incomplete. The search runs without errors, but the user expects more events. What should the administrator check first?

Increase the search head's memory allocation to improve search performance.

Check the search head's license usage to see if it has exceeded its quota.

Restart the search head to clear any cached search results.

Review the search job inspector to see if the search was limited by time range or index restrictions.

When diagnosing a Splunk crash, which of the following is a key resource to examine?

The search head's authentication settings.

The system's memory and disk usage.

SplunkEnterprise Certified Architect

Domain 6Objective 2

Common Issues and Troubleshooting SPLK-2002 Practice Questions (Page 2)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

Questions 6–10

6foundation · easy
Which tool or log provides detailed information about search job performance?
Select an answer first
7expert · medium
A Splunk administrator is troubleshooting a license violation that occurs only on weekends. The license usage is within the quota on weekdays but exceeds it on Saturdays and Sundays. What is the most likely cause and the appropriate action?
Select an answer first
8foundation · easy
A forwarder is not sending data to the indexer. What is a common corrective action?
Select an answer first
9application · medium
A user reports that a search returns results that are incomplete. The search runs without errors, but the user expects more events. What should the administrator check first?
Select an answer first
10foundation · easy
When diagnosing a Splunk crash, which of the following is a key resource to examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.