A Splunk indexer cluster is configured with a replication factor of 2 and a search factor of 1. The administrator wants to free up storage space by archiving older data to a cold storage system, but must ensure that the archived data can be restored if needed. Which action should be taken?

Increase the bucket rolling period.

Freeze the buckets and then thaw them when needed.

Reduce the replication factor to 1.

What happens to a bucket when it is frozen in an indexer cluster?

It is archived or deleted, freeing up storage.

It is replicated to more peers for redundancy.

It is compressed to reduce its size.

It is moved to a warm state and remains searchable.

In volume-based storage utilization, how is storage allocated in an indexer cluster?

By replicating all data to a separate storage volume for redundancy.

By dynamically expanding storage based on real-time data ingestion rates.

By assigning a fixed amount of disk space to each index, regardless of data volume.

By configuring a total storage volume that is shared among all indexes and peers.

What is the purpose of rolling a bucket in an indexer cluster?

To delete old data from the cluster.

To close the current hot bucket and start a new one.

To replicate buckets to a different cluster.

To compress buckets to save storage.

SplunkEnterprise Certified Architect

Domain 3Objective 5

Indexer Cluster Storage Utilization Options SPLK-2002 Practice Questions (Page 1)

Part of the Indexer Clustering domain, which makes up ~25% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–15 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 1–5

1application · medium
A Splunk indexer cluster is configured with a replication factor of 2 and a search factor of 1. The administrator wants to free up storage space by archiving older data to a cold storage system, but must ensure that the archived data can be restored if needed. Which action should be taken?
Select an answer first
2foundation · easy
What happens to a bucket when it is frozen in an indexer cluster?
Select an answer first
3foundation · easy
In volume-based storage utilization, how is storage allocated in an indexer cluster?
Select an answer first
4application · medium
An organization runs a Splunk indexer cluster with a replication factor of 3. They want to reduce storage consumption by making only one copy of each bucket searchable, while still maintaining redundancy for disaster recovery. What should the search factor be set to?
Select an answer first
5foundation · easy
What is the purpose of rolling a bucket in an indexer cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.