When troubleshooting a license issue, which of the following should be checked after confirming that license usage is within the quota?

The search head's authentication settings.

The indexer's storage capacity.

The forwarder's output.conf settings.

The license master's configuration and pool assignments.

When troubleshooting an input issue where a file is not being indexed, what is a common corrective action?

Increase the search head's memory.

Change the indexer's port number.

Fix the file permissions so the Splunk process can read it.

When troubleshooting a slow search, which of the following should be checked?

The license master's configuration.

The indexer's CPU and memory usage.

The inputs.conf file on the search head.

The forwarder's output settings.

Which of the following is a useful technique for diagnosing a Splunk crash?

Checking the license pool assignments.

Reviewing the search job inspector.

Verifying the forwarder's SSL settings.

Reviewing stack traces in the splunkd.log.

A Splunk administrator notices that events are being indexed twice for a specific input. The input is a file that is being monitored by a forwarder. What is the most likely cause of duplicate events?

The forwarder is sending data to two different indexers.

The file has a large 'crcSalt' value, causing Splunk to re-read the file.

The indexer is configured to index the same data twice.

The file is being monitored by two different inputs or forwarders.

SplunkEnterprise Certified Architect

Domain 6Objective 2

Common Issues and Troubleshooting SPLK-2002 Practice Questions (Page 6)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

Questions 26–30

26foundation · easy
When troubleshooting a license issue, which of the following should be checked after confirming that license usage is within the quota?
Select an answer first
27foundation · easy
When troubleshooting an input issue where a file is not being indexed, what is a common corrective action?
Select an answer first
28foundation · easy
When troubleshooting a slow search, which of the following should be checked?
Select an answer first
29foundation · easy
Which of the following is a useful technique for diagnosing a Splunk crash?
Select an answer first
30application · medium
A Splunk administrator notices that events are being indexed twice for a specific input. The input is a file that is being monitored by a forwarder. What is the most likely cause of duplicate events?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.