Performance and Monitoring SPLK-2002 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   Which type of information can you obtain from the Job Inspector?

   • AThe exact content of the raw event data returned by the search.
   • BThe number of events scanned and the time taken for each search phase.
   • CThe historical performance trends of all searches run by a specific user.
   • DThe list of users who have access to the search job's results.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Splunk admin is troubleshooting a search that is slow only when run by a specific user. Job Inspector shows normal scan counts and execution times when run by other users. What is the most likely cause?

   • AThe user has a role with a higher search time limit, allowing longer-running searches.
   • BThe user's role has a lower search time limit, causing the search to be killed early.
   • CThe user's search is using a different time range or search pattern.
   • DThe user is running the search on a search head with limited resources.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   In the Job Inspector, what does the 'scan count' metric represent?

   • AThe number of events returned to the user as search results.
   • BThe number of indexers that participated in the search.
   • CThe total number of events that were read from disk during the search.
   • DThe number of times the search command was executed.
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   Which section of the Job Inspector provides a high-level summary of the search job, including the search string and the user who ran it?

   • ASearch commands
   • BPerformance summary
   • CSearch job properties
   • DMessages
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Splunk admin notices that a frequently run search takes 30 seconds longer than usual. In Job Inspector, the 'scan count' is 50 million, 'event count' is 10 million, and 'result count' is 5,000. The search returns the correct results. What is the most likely cause of the performance degradation?

   • AThe search is returning too many results, causing network latency.
   • BThe search is using too many buckets, causing excessive memory usage.
   • CThe search is scanning too many events because of a missing or inefficient time range filter.
   • DThe search is hitting a disk I/O bottleneck because of concurrent searches.
   Reveal Solution Discussion Select an answer first