Indexer Cluster Storage Utilization Options SPLK-2002 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Splunk administrator notices that one index in a cluster is consuming a disproportionate amount of storage, causing other indexes to fail replication due to lack of space. The administrator wants to prevent this by limiting the storage that this index can use. Which configuration should be applied?

   • ASet a maximum size for the index's buckets.
   • BSet a lower search factor for that index.
   • CAssign the index to a volume with a maximum capacity.
   • DReduce the replication factor for that index.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Splunk indexer cluster is running low on storage. The administrator needs to free up space without losing the ability to search recent data. The cluster has a replication factor of 2 and a search factor of 1. Which action will reduce storage utilization while preserving searchability of the most recent data?

   • ASet a shorter retention period for older buckets by freezing them earlier.
   • BConfigure a shorter bucket rolling period.
   • CLower the search factor to 0 for all indexes.
   • DReduce the replication factor to 1 for all indexes.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Splunk administrator suspects that one indexer in a cluster is running out of storage space, which could cause replication failures. Which command or tool should be used to quickly assess the current storage utilization of each indexer in the cluster?

   • ARun 'splunk list index' on the cluster master.
   • BUse the 'splunk search' command to query _internal for storage metrics.
   • CRun 'splunk show storage' on each indexer.
   • DUse the Monitoring Console's Indexer Clustering dashboard.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A Splunk administrator is troubleshooting a search performance issue in an indexer cluster. The cluster has a replication factor of 3 and a search factor of 1. Searches are taking longer than expected, and the administrator suspects that the search factor is too low. Which action should be taken to improve search performance?

   • ADecrease the replication factor to 2.
   • BIncrease the search factor to 2 or 3.
   • CDecrease the search factor to 0.
   • DIncrease the replication factor to 4.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Splunk administrator is managing an indexer cluster with multiple indexes. One index is used for compliance data that must be retained for 7 years, while another index is used for operational logs that only need 30 days of retention. The cluster is running out of storage. The administrator wants to ensure that the compliance data is never lost, but the operational logs can be deleted after 30 days. Which approach should be taken?

   • ASet a higher search factor for the compliance index and a lower one for the operational index.
   • BSet a longer retention period for the compliance index and a shorter one for the operational index, and use volumes to allocate separate storage pools.
   • CConfigure the operational index to freeze buckets after 30 days and the compliance index to never freeze.
   • DIncrease the replication factor for the compliance index and decrease it for the operational index.
   Reveal Solution Discussion Select an answer first