An organization runs a Splunk indexer cluster with a replication factor of 3. They plan to add a new data source that will generate a large volume of low-priority logs. The architect wants to ensure that this new data does not consume the same storage pool as critical data, so that critical data can still replicate fully even if the new source grows unexpectedly. Which storage utilization option should be used?

Set a lower search factor for the new data to reduce the number of searchable copies.

Create a new volume and assign it to the indexes that store the new data.

Increase the replication factor for the new data to ensure it is stored redundantly.

Configure the new data to use a different bucket rolling policy.

What does the search factor determine in an indexer cluster?

The maximum number of concurrent searches allowed.

The number of copies of each bucket that are searchable.

The number of buckets that can be searched in a single query.

The number of search heads that can query the cluster.

What is the primary trade-off when choosing a higher replication factor?

Simpler cluster management at the cost of reduced data availability.

Increased redundancy at the cost of higher storage consumption.

Improved search performance at the cost of reduced data retention.

Reduced storage consumption at the cost of lower search performance.

SplunkEnterprise Certified Architect

Domain 3Objective 5

Indexer Cluster Storage Utilization Options SPLK-2002 Practice Questions (Page 2)

Part of the Indexer Clustering domain, which makes up ~25% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–15 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 6–10

6application · medium
An organization runs a Splunk indexer cluster with a replication factor of 3. They plan to add a new data source that will generate a large volume of low-priority logs. The architect wants to ensure that this new data does not consume the same storage pool as critical data, so that critical data can still replicate fully even if the new source grows unexpectedly. Which storage utilization option should be used?
Select an answer first
7foundation · easy
What does the search factor determine in an indexer cluster?
Select an answer first
8foundation · easy
What is the primary trade-off when choosing a higher replication factor?
Select an answer first
9application · medium
A Splunk architect is planning a new indexer cluster. The expected daily ingest is 1 TB, with a 30-day retention period. The cluster must tolerate the loss of one indexer without losing data, and searches must be able to run against any copy of the data. The architect wants to minimize storage consumption while meeting these requirements. What is the minimum total storage capacity (in TB) that must be provisioned across the cluster?
Select an answer first
10foundation · easy
An indexer cluster ingests 100 GB of data per day. The replication factor is 3 and the search factor is 2. What is the total storage required per day, ignoring overhead?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Indexer Cluster Storage Utilization Options SPLK-2002 Practice Questions (Page 2)

Questions 6–10

What does the search factor determine in an indexer cluster?

What is the primary trade-off when choosing a higher replication factor?

An indexer cluster ingests 100 GB of data per day. The replication factor is 3 and the search factor is 2. What is the total storage required per day, ignoring overhead?

Keep studying — Indexer Clustering