Peer Offline and Decommission SPLK-2002 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A peer indexer in a cluster with replication_factor=3 and search_factor=2 has been offline for 30 minutes. The master has not yet marked it as down. What is the immediate impact on search and replication?

   • AThe cluster immediately rebalances buckets to other peers to maintain replication_factor, so there is no impact on search or replication.
   • BSearch is unaffected because the search_factor ensures copies are on other peers, and replication continues normally to the remaining peers.
   • CSearch results may be incomplete for buckets that were only on that peer, and replication of new buckets is paused until the peer returns.
   • DNew data is not indexed until the peer comes back online, preventing any replication issues.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which Splunk CLI command is used to check the status of peers in an indexer cluster?

   • Asplunk cluster status
   • Bsplunk display peers
   • Csplunk list cluster-peers
   • Dsplunk show peer-status
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A peer indexer has been marked down by the master. The cluster has replication_factor=3 and search_factor=2. What is the most likely impact on search and replication while the peer is down?

   • ASearch may return incomplete results for buckets that were only on the downed peer, and replication violations may occur for new buckets.
   • BThe cluster immediately rebalances buckets to other peers to maintain replication_factor, so there is no impact.
   • CSearch is fully available because search_factor=2 ensures a copy on another peer, and replication continues normally.
   • DNew data is not indexed until the peer returns, preventing any replication issues.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary goal of bucket rebalancing after a peer is decommissioned?

   • ATo reduce the total number of buckets in the cluster.
   • BTo move all buckets to the search heads for faster search performance.
   • CTo maintain data availability and redundancy by evenly distributing buckets across remaining peers.
   • DTo ensure that all buckets are stored on the master for centralized management.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An administrator has just run `splunk decommission peer <peer_name>` from the master. What is the most reliable way to confirm that the decommissioning process has completed successfully?

   • ACheck the peer's status with `splunk show peer-status` and verify it shows as 'Decommissioned'.
   • BCheck that the master has removed the peer from its configuration file.
   • CVerify that the peer's service has stopped automatically.
   • DConfirm that the peer's buckets have been deleted from its local storage.
   Reveal Solution Discussion Select an answer first