A Splunk administrator notices that the license usage page shows a warning state. What does this indicate?

The license pool is misconfigured.

The license has expired and needs to be renewed.

The license usage has exceeded the warning threshold but not the violation threshold.

The license master is not reachable.

A user reports that a search returns incorrect results. The search is 'index=web sourcetype=access_combined status=500'. The administrator checks the job inspector and sees that the search ran successfully. What is the most likely cause of the incorrect results?

The search head is caching old results, so the search is returning stale data.

The search is using the wrong time range, so it is missing events.

The 'status' field is not extracted correctly for some events, so the search misses those events.

The indexer is not returning all events due to a license violation.

Which of the following is a common sign that a Splunk license violation has occurred?

Search results are delayed by several minutes.

Forwarders stop sending data to the indexers.

The license usage page shows a red banner indicating the quota was exceeded.

The search head shows a 'peer not found' error.

A Splunk administrator is troubleshooting an input that is not indexing data. The input is a network input that receives data from a remote device. The device is sending data, but no events are appearing in the index. What should the administrator check first?

Check the license usage to see if the indexer has exceeded its quota.

Restart the forwarder to re-initialize the network input.

Verify that the network input is listening on the correct port and that the device is sending to that port.

Check the inputs.conf file to ensure the input is enabled.

A Splunk indexer has been restarting unexpectedly several times a day. The administrator checks the operating system logs and finds that the process is not being killed by the OS. What should the administrator do next to determine if Splunk is crashing?

Check the inputs.conf file for any misconfigured inputs that might cause a restart.

Verify that the license pool is not over-allocated, which could cause the indexer to restart.

Run a search to check for duplicate events, which might indicate a crash.

Look for core dump files and review the Splunkd.log for error messages around the time of the restarts.

SplunkEnterprise Certified Architect

Domain 6Objective 2

Common Issues and Troubleshooting SPLK-2002 Practice Questions (Page 4)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

Questions 16–20

16foundation · easy
A Splunk administrator notices that the license usage page shows a warning state. What does this indicate?
Select an answer first
17expert · medium
A user reports that a search returns incorrect results. The search is 'index=web sourcetype=access_combined status=500'. The administrator checks the job inspector and sees that the search ran successfully. What is the most likely cause of the incorrect results?
Select an answer first
18foundation · easy
Which of the following is a common sign that a Splunk license violation has occurred?
Select an answer first
19application · medium
A Splunk administrator is troubleshooting an input that is not indexing data. The input is a network input that receives data from a remote device. The device is sending data, but no events are appearing in the index. What should the administrator check first?
Select an answer first
20application · medium
A Splunk indexer has been restarting unexpectedly several times a day. The administrator checks the operating system logs and finds that the process is not being killed by the OS. What should the administrator do next to determine if Splunk is crashing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.