A user runs a search that returns 1,000 results but takes 45 seconds. Job Inspector shows 'scan count' of 10 million, 'event count' of 500,000, and 'result count' of 1,000. The search uses a 'where' command to filter on a calculated field. What is the most likely performance issue?

The 'where' command is forcing a scan of all events because it operates on calculated fields.

The search is hitting a disk I/O bottleneck because of concurrent searches.

The search is returning too many results, causing network latency.

The search is using too many buckets, causing memory pressure.

SplunkEnterprise Certified Architect

Domain 6Objective 3

Performance and Monitoring SPLK-2002 Practice Questions (Page 5)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

Questions 21–22

21foundation · medium
Which phase of a search job involves the actual retrieval of events from the index?
Select an answer first
22application · medium
A user runs a search that returns 1,000 results but takes 45 seconds. Job Inspector shows 'scan count' of 10 million, 'event count' of 500,000, and 'result count' of 1,000. The search uses a 'where' command to filter on a calculated field. What is the most likely performance issue?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Performance and Monitoring SPLK-2002 Practice Questions (Page 5)

Questions 21–22

Which phase of a search job involves the actual retrieval of events from the index?

A user runs a search that returns 1,000 results but takes 45 seconds. Job Inspector shows 'scan count' of 10 million, 'event count' of 500,000, and 'result count' of 1,000. The search uses a 'where' command to filter on a calculated field. What is the most likely performance issue?

Keep studying — Troubleshooting