A Splunk admin is troubleshooting an issue where a forwarder is not sending data to the indexer. The forwarder's splunkd.log shows repeated 'Connection refused' errors. The admin has verified that the indexer is running and the network path is clear. Which additional diagnostic step should the admin take to isolate the issue?

Check the indexes.conf file on the indexer to verify the index is enabled.

Check the outputs.conf file on the forwarder to verify the indexer's hostname and port are correct.

Check the inputs.conf file on the forwarder to verify the data inputs are configured.

Check the server.conf file on the indexer to verify the listening port is configured.

A Splunk admin is investigating a disk space issue on an indexer. The admin has identified that the _internal index is consuming more disk space than expected. The admin wants to determine if the growth is due to increased logging from a specific component or a misconfiguration. Which approach should the admin take?

Run the 'splunk diag' command and review the output for log file sizes.

Use the Monitoring Console to view the 'Indexes and Volumes' page for the _internal index.

Search the _internal index for the 'splunkd' sourcetype and group events by component to see which component is generating the most logs.

Check the indexes.conf file to see the configured maximum size for the _internal index.

SplunkEnterprise Certified Architect

Domain 6Objective 1

Diagnostic Resources and Logs SPLK-2002 Practice Questions (Page 2)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

6concepts

Questions 6–10

6foundation · easy
Which internal index in Splunk Enterprise stores operational and performance data generated by Splunk itself, including logs from splunkd and metrics?
Select an answer first
7expert · hard
A Splunk admin is troubleshooting an issue where a forwarder is not sending data to the indexer. The forwarder's splunkd.log shows repeated 'Connection refused' errors. The admin has verified that the indexer is running and the network path is clear. Which additional diagnostic step should the admin take to isolate the issue?
Select an answer first
8expert · hard
A Splunk admin is investigating a disk space issue on an indexer. The admin has identified that the _internal index is consuming more disk space than expected. The admin wants to determine if the growth is due to increased logging from a specific component or a misconfiguration. Which approach should the admin take?
Select an answer first
9foundation · easy
Which built-in diagnostic resource in Splunk Enterprise is a command-line utility that collects system information, configuration, and logs into a compressed archive for support analysis?
Select an answer first
10foundation · easy
Which Splunk Enterprise command or search is commonly used to monitor the size of internal indexes and identify which indexes are consuming the most disk space?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Diagnostic Resources and Logs SPLK-2002 Practice Questions (Page 2)

Questions 6–10

Which internal index in Splunk Enterprise stores operational and performance data generated by Splunk itself, including logs from splunkd and metrics?

Which built-in diagnostic resource in Splunk Enterprise is a command-line utility that collects system information, configuration, and logs into a compressed archive for support analysis?

Which Splunk Enterprise command or search is commonly used to monitor the size of internal indexes and identify which indexes are consuming the most disk space?

Keep studying — Troubleshooting