A Splunk admin is troubleshooting a slow search. Job Inspector shows a high 'scan count' and a high 'disk read' metric, but the 'event count' is low. The search uses a field that is not indexed. What is the most likely cause?

The search is returning too many results, causing high disk reads.

The search is performing a full index scan because the field is unindexed.

The search is hitting a network bottleneck between indexers.

The search is using too many buckets, causing excessive disk reads.

A Splunk admin is investigating a search that is slow only during peak hours. Job Inspector shows normal scan counts and event counts, but the 'execution time' is high. The search is not complex. What is the most likely cause?

The search is using a summary index that is not up to date.

The search is returning too many results, causing network latency.

The search is using an unindexed field, causing high disk reads.

Resource contention on the search head or indexers due to concurrent searches.

Using Job Inspector data, which approach would best resolve a search that is slow due to a high scan count?

Disable the summary index to avoid extra processing.

Increase the number of search peers to distribute the load.

Change the search mode from fast to verbose.

Narrow the search time range and add more specific filters to reduce the number of events scanned.

SplunkEnterprise Certified Architect

Domain 6Objective 3

Performance and Monitoring SPLK-2002 Practice Questions (Page 4)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

Questions 16–20

16application · medium
A Splunk admin is troubleshooting a slow search. Job Inspector shows a high 'scan count' and a high 'disk read' metric, but the 'event count' is low. The search uses a field that is not indexed. What is the most likely cause?
Select an answer first
17foundation · medium
Which metric in the Job Inspector indicates the total time the search job took to complete?
Select an answer first
18application · medium
A Splunk admin is investigating a search that is slow only during peak hours. Job Inspector shows normal scan counts and event counts, but the 'execution time' is high. The search is not complex. What is the most likely cause?
Select an answer first
19foundation · medium
In the Job Inspector, which section shows the time spent in each phase of the search job?
Select an answer first
20foundation · medium
Using Job Inspector data, which approach would best resolve a search that is slow due to a high scan count?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Performance and Monitoring SPLK-2002 Practice Questions (Page 4)

Questions 16–20

A Splunk admin is troubleshooting a slow search. Job Inspector shows a high 'scan count' and a high 'disk read' metric, but the 'event count' is low. The search uses a field that is not indexed. What is the most likely cause?

Which metric in the Job Inspector indicates the total time the search job took to complete?

A Splunk admin is investigating a search that is slow only during peak hours. Job Inspector shows normal scan counts and event counts, but the 'execution time' is high. The search is not complex. What is the most likely cause?

In the Job Inspector, which section shows the time spent in each phase of the search job?

Using Job Inspector data, which approach would best resolve a search that is slow due to a high scan count?

Keep studying — Troubleshooting