In a search head cluster, if the KV Store captain fails, what happens to KV Store operations?

A new captain is elected from the remaining members and operations continue

The cluster becomes read-only until a new captain is appointed

All KV Store operations stop until the captain is restored

The KV Store data is lost and must be restored from backup

An administrator is configuring a KV Store collection in a search head cluster. The collection will store data that is written frequently and must be durable. The administrator wants to ensure that writes are acknowledged only after they are persisted to disk. Which setting should be configured?

Set 'replication_factor' to a higher value.

Set 'cache_size' to a higher value.

A search head cluster is experiencing intermittent KV Store write failures. The errors in the kvstore.log indicate that the captain is not reachable. The administrator checks the captain's status and finds that it is healthy. What is the most likely cause?

The replication factor is too low.

Network connectivity issues between the members and the captain.

The captain is overloaded with writes.

The collection is not properly configured.

A search head cluster has three members. A KV Store collection is configured with a replication factor of 2. One member fails. What is the impact on KV Store data availability?

All KV Store operations stop until the member is restored.

Data is lost because the replication factor is not high enough.

The KV Store captain automatically increases the replication factor to compensate.

Data is still available on the remaining members, but writes may be limited.

An administrator is troubleshooting a KV Store collection that is not appearing on all search head cluster members. The collection is defined in the app's default/kvstore.conf. What is the most likely cause?

The replication factor is set to 1.

The KV Store captain is not replicating the collection.

The app has not been deployed to all members via the deployer.

The collection name is too long.

SplunkEnterprise Certified Architect

Domain 4Objective 6

KV Store Collection in Splunk Clusters SPLK-2002 Practice Questions (Page 4)

Part of the Search Head Clustering and KV Store domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 16–20

16foundation · easy
In a search head cluster, if the KV Store captain fails, what happens to KV Store operations?
Select an answer first
17expert · medium
An administrator is configuring a KV Store collection in a search head cluster. The collection will store data that is written frequently and must be durable. The administrator wants to ensure that writes are acknowledged only after they are persisted to disk. Which setting should be configured?
Select an answer first
18expert · medium
A search head cluster is experiencing intermittent KV Store write failures. The errors in the kvstore.log indicate that the captain is not reachable. The administrator checks the captain's status and finds that it is healthy. What is the most likely cause?
Select an answer first
19expert · medium
A search head cluster has three members. A KV Store collection is configured with a replication factor of 2. One member fails. What is the impact on KV Store data availability?
Select an answer first
20application · medium
An administrator is troubleshooting a KV Store collection that is not appearing on all search head cluster members. The collection is defined in the app's default/kvstore.conf. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.