A Splunk administrator is troubleshooting a slow search. The search is a simple 'index=web' over the last 30 days. The search head and indexers have plenty of resources. What is the most effective way to improve search performance?

Disable the search head's job inspector to reduce overhead.

Narrow the time range to the last 7 days if possible.

Increase the number of search peers to distribute the load.

Use a faster search command like 'stats' instead of 'search'.

A Splunk indexer is crashing intermittently. The administrator finds a core dump and a stack trace that points to a memory allocation failure. The system has 64 GB of RAM, and the Splunk process is configured with a maxMemMB setting of 8 GB. What is the most likely cause of the crash?

The license is violated, and Splunk is crashing as a result.

The disk is full, causing Splunk to crash when writing to the index.

The indexer is receiving too many inputs, overwhelming the memory allocation.

The maxMemMB setting is too high for the available system memory, causing the process to exhaust memory.

A Splunk administrator finds that a log file input is not indexing new events. The file is being written to, but the forwarder is not picking up the changes. What is the most likely cause and the appropriate action?

The file permissions are incorrect; fix the permissions so the forwarder can read the file.

The input is configured with a large 'crcSalt' value; reduce it to speed up file reading.

The index is full; delete old events to make room.

The forwarder is not connected to the indexer; restart the forwarder.

SplunkEnterprise Certified Architect

Domain 6Objective 2

Common Issues and Troubleshooting SPLK-2002 Practice Questions (Page 5)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

Questions 21–25

21application · medium
A Splunk administrator is troubleshooting a slow search. The search is a simple 'index=web' over the last 30 days. The search head and indexers have plenty of resources. What is the most effective way to improve search performance?
Select an answer first
22expert · medium
A Splunk indexer is crashing intermittently. The administrator finds a core dump and a stack trace that points to a memory allocation failure. The system has 64 GB of RAM, and the Splunk process is configured with a maxMemMB setting of 8 GB. What is the most likely cause of the crash?
Select an answer first
23foundation · easy
Which of the following is a common sign of an input issue in Splunk?
Select an answer first
24foundation · easy
What file or log is most likely to contain evidence of a Splunk crash, such as a core dump?
Select an answer first
25application · medium
A Splunk administrator finds that a log file input is not indexing new events. The file is being written to, but the forwarder is not picking up the changes. What is the most likely cause and the appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Common Issues and Troubleshooting SPLK-2002 Practice Questions (Page 5)

Questions 21–25

A Splunk administrator is troubleshooting a slow search. The search is a simple 'index=web' over the last 30 days. The search head and indexers have plenty of resources. What is the most effective way to improve search performance?

A Splunk indexer is crashing intermittently. The administrator finds a core dump and a stack trace that points to a memory allocation failure. The system has 64 GB of RAM, and the Splunk process is configured with a maxMemMB setting of 8 GB. What is the most likely cause of the crash?

Which of the following is a common sign of an input issue in Splunk?

What file or log is most likely to contain evidence of a Splunk crash, such as a core dump?

A Splunk administrator finds that a log file input is not indexing new events. The file is being written to, but the forwarder is not picking up the changes. What is the most likely cause and the appropriate action?

Keep studying — Troubleshooting