You have decommissioned a search head from your cluster. Which of the following is a post-decommissioning verification step?

Delete the member's apps from the deployment server.

Re-run `splunk add shcluster-member` on the removed member.

Restart all remaining members to refresh the cluster.

Confirm that the member no longer appears in `splunk show shcluster-status`.

You have stopped Splunk on a search head and run `splunk remove shcluster-member` on the captain. What is the next step to complete the decommissioning?

Reinstall the member's apps on the captain.

Delete the member's `server.conf` file.

Restart the captain to finalize the removal.

Verify the member no longer appears in `splunk show shcluster-status`.

You are decommissioning a search head. The member has a scheduled search that is owned by a user who has left the company. What should you do with this scheduled search before decommissioning?

Back up the scheduled search to the captain.

Share the scheduled search with all users.

Reassign the scheduled search to an active user or delete it.

Do nothing; the captain will reassign it automatically.

You are preparing to decommission a search head from a cluster. The member hosts a custom app that is not deployed elsewhere. What is the most important pre-decommissioning check?

Ensure the custom app is deployed to all other members via a deployment server.

Check that the member has no active scheduled searches.

Confirm that the member's `server.conf` is backed up locally.

Verify that the member's search artifacts are backed up to the captain.

You are decommissioning a search head from a cluster. The member has a custom app that is deployed via a deployment server, but the app has local configuration changes that were made directly on the member. What is the best approach to preserve these changes?

Export the local configuration changes and merge them into the deployment server's app package.

Do nothing; the deployment server will automatically sync the changes to other members.

Copy the entire app from the member to the captain.

Back up the member's `server.conf` and restore it on another member.

SplunkEnterprise Certified Architect

Domain 4Objective 5

Search Head Member Addition and Decommissioning SPLK-2002 Practice Questions (Page 3)

Part of the Search Head Clustering and KV Store domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

6concepts

Questions 11–15

11application · easy
You have decommissioned a search head from your cluster. Which of the following is a post-decommissioning verification step?
Select an answer first
12application · medium
You have stopped Splunk on a search head and run `splunk remove shcluster-member` on the captain. What is the next step to complete the decommissioning?
Select an answer first
13application · medium
You are decommissioning a search head. The member has a scheduled search that is owned by a user who has left the company. What should you do with this scheduled search before decommissioning?
Select an answer first
14application · medium
You are preparing to decommission a search head from a cluster. The member hosts a custom app that is not deployed elsewhere. What is the most important pre-decommissioning check?
Select an answer first
15expert · hard
You are decommissioning a search head from a cluster. The member has a custom app that is deployed via a deployment server, but the app has local configuration changes that were made directly on the member. What is the best approach to preserve these changes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.