A Splunk admin is monitoring the health of a single-instance Splunk deployment. The admin wants to see the current size of the _internal index and the rate at which it is growing. Which tool or search should the admin use?

Use the Monitoring Console's 'Indexes and Volumes' page to view the _internal index size and growth.

Run the 'splunk diag' command and review the output for index size information.

Check the indexes.conf file to see the configured maximum size for the _internal index.

Run a search against the _internal index using the 'index=_internal' and 'sourcetype=splunkd' filters to see event counts.

SplunkEnterprise Certified Architect

Domain 6Objective 1

Diagnostic Resources and Logs SPLK-2002 Practice Questions (Page 3)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

6concepts

Questions 11–15

11foundation · easy
Which internal log file in Splunk Enterprise records performance metrics such as indexing throughput, search execution times, and resource usage?
Select an answer first
12foundation · easy
Which diagnostic tool in Splunk Enterprise is specifically designed to collect and package system diagnostics for Splunk Support, and can be run with the `splunk diag` command?
Select an answer first
13application · easy
A Splunk admin is troubleshooting a problem on a Windows indexer where the splunkd service fails to start. The admin needs to gather diagnostic information to send to Splunk Support. Which command should the admin run on the Windows machine?
Select an answer first
14application · easy
A Splunk admin is using the Monitoring Console to troubleshoot a problem where search results are slow. The admin wants to see the health of the search heads and indexers in the environment. Which section of the Monitoring Console should the admin use?
Select an answer first
15application · medium
A Splunk admin is monitoring the health of a single-instance Splunk deployment. The admin wants to see the current size of the _internal index and the rate at which it is growing. Which tool or search should the admin use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Diagnostic Resources and Logs SPLK-2002 Practice Questions (Page 3)

Questions 11–15

Which internal log file in Splunk Enterprise records performance metrics such as indexing throughput, search execution times, and resource usage?

Which diagnostic tool in Splunk Enterprise is specifically designed to collect and package system diagnostics for Splunk Support, and can be run with the `splunk diag` command?

A Splunk admin is troubleshooting a problem on a Windows indexer where the splunkd service fails to start. The admin needs to gather diagnostic information to send to Splunk Support. Which command should the admin run on the Windows machine?

A Splunk admin is using the Monitoring Console to troubleshoot a problem where search results are slow. The admin wants to see the health of the search heads and indexers in the environment. Which section of the Monitoring Console should the admin use?

A Splunk admin is monitoring the health of a single-instance Splunk deployment. The admin wants to see the current size of the _internal index and the rate at which it is growing. Which tool or search should the admin use?

Keep studying — Troubleshooting