You have added a new search head to your cluster and it appears as 'Up' in `splunk show shcluster-status`. What is the next step to ensure it is fully functional?

Restart the captain to sync the new member.

Install and configure the same apps as the other members.

Verify the member's `server.conf` is correct.

Run `splunk init shcluster-config` on the new member.

After initializing the cluster configuration on a new search head, what is the next step to add it to the cluster?

Restart the search head and run `splunk bootstrap shcluster`.

Run `splunk join shcluster` on the new search head.

Copy the cluster configuration files from an existing member to the new search head.

Run `splunk add shcluster-member` on the new search head.

After adding a new search head to your cluster, you want to verify it is functioning correctly. Which command or check provides the most direct confirmation that the new member is an active part of the cluster?

Check the new member's `splunkd.log` for the absence of errors.

Run `splunk show shcluster-status` on the captain and confirm the new member is listed with a status of 'Up'.

Verify that the new member can search an index directly via the CLI.

Confirm that the new member's `server.conf` contains the `shcluster` stanza.

What should be done with the search head's local configurations before decommissioning?

Delete all local configurations to prevent them from being replicated.

Copy the local configurations to all other search heads manually.

Back up the configuration files to the deployer.

Ensure that any local configurations are also present in the deployer's configuration bundle.

You have just added a new search head to your cluster and restarted it. You want to confirm that the new member is ready to serve search requests. Which of the following is the most reliable indicator?

The captain's `server.conf` lists the new member.

The new member's `splunkd.log` shows no errors.

The new member appears in `splunk show shcluster-status` with a status of 'Up'.

The new member can run a search locally.

SplunkEnterprise Certified Architect

Domain 4Objective 5

Search Head Member Addition and Decommissioning SPLK-2002 Practice Questions (Page 2)

Part of the Search Head Clustering and KV Store domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

6concepts

Questions 6–10

6application · medium
You have added a new search head to your cluster and it appears as 'Up' in `splunk show shcluster-status`. What is the next step to ensure it is fully functional?
Select an answer first
7foundation · easy
After initializing the cluster configuration on a new search head, what is the next step to add it to the cluster?
Select an answer first
8application · medium
After adding a new search head to your cluster, you want to verify it is functioning correctly. Which command or check provides the most direct confirmation that the new member is an active part of the cluster?
Select an answer first
9foundation · easy
What should be done with the search head's local configurations before decommissioning?
Select an answer first
10application · medium
You have just added a new search head to your cluster and restarted it. You want to confirm that the new member is ready to serve search requests. Which of the following is the most reliable indicator?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.