License Master Configuration in a Clustered Environment SPLK-2002 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the immediate impact on a cluster when the License Master detects a license violation?

   • AThe cluster continues to index but marks data as 'violation' and logs warnings.
   • BAll indexing stops immediately until the license is renewed.
   • CThe cluster peers are automatically removed from the cluster.
   • DSearch heads are disabled until the license is renewed.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Splunk architect is deploying a new indexer cluster with six peers and two search heads. The organization has a single enterprise license with a daily volume cap. The architect must ensure that all cluster members and search heads report their usage to a single authoritative licensing source. What is the minimum configuration required to accomplish this?

   • AInstall a dedicated License Master, then configure each peer and search head with the License Master's host and management port.
   • BInstall a License Master on each search head and configure the indexer peers to report to the first search head.
   • CDesignate one of the indexer peers as the License Master and configure only the search heads to point to it.
   • DConfigure the cluster master to act as the License Master and have all peers and search heads report to it automatically.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Splunk administrator wants to be alerted when the cluster's license usage reaches 80% of the daily quota. The administrator has access to the License Master and wants to set up an alert that will trigger once per day. What is the most efficient way to accomplish this?

   • ACreate a scheduled search on the License Master that queries `_internal` for `license_usage.log` and calculates the percentage of the quota used, then set an alert condition.
   • BEnable the 'License Usage' alert in the License Master's settings page, which automatically sends an email at 80% usage.
   • CConfigure the cluster master to monitor license usage and send an alert via the monitoring console.
   • DUse a forwarder to send the `license_usage.log` to an external system and set up an alert there.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Splunk administrator needs to identify which forwarders are sending the most data to the cluster, contributing to license usage. The administrator has access to the License Master. What is the most effective way to get this information?

   • AReview the `inputs.conf` on the forwarders to see which ones have the highest volume settings.
   • BCheck the `metrics.log` on each indexer peer to see which forwarders are sending the most data.
   • CSearch the `license_usage.log` on the License Master and group by the `host` field to see usage per forwarder.
   • DUse the `splunk list forward-server` command on the License Master to see forwarder connections.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the recommended approach to provide License Master redundancy in a Splunk Enterprise deployment?

   • AConfigure a secondary License Master and manually promote it in case of failure.
   • BUse Splunk's built-in clustering to automatically failover to a standby License Master.
   • CUse a load balancer to distribute license requests across multiple License Masters.
   • DRun multiple License Masters in an active-active configuration.
   Reveal Solution Discussion Select an answer first