What happens to a bucket when it reaches the frozen state in a non-smart store deployment?

It is converted to a read-only format and remains searchable

It is moved to the search head for long-term storage

It is deleted from the indexer, and optionally archived to external storage

It is compressed and stored in a special frozen directory on the same disk

When estimating storage for a non-smart store deployment, why is it important to account for index overhead (e.g., tsidx files) in addition to raw data?

Because tsidx files can consume as much or more space than the raw data, depending on the number of unique terms

Because tsidx files are stored on separate disks and require additional network bandwidth

Because tsidx files are not compressed and therefore always double the storage requirement

Because tsidx files are replicated across indexers, increasing the replication factor

Which of the following is stored in a bucket's metadata (e.g., in the .meta file)?

The search head's configuration and saved searches

The indexer's authentication and authorization policies

Information about the bucket such as its time range, event count, and size

The raw event data in compressed form

When planning storage for a Splunk indexer, which of the following factors must be considered?

Retention period, replication factor, and data input rate

Search head load, number of users, and license type

Operating system, hardware vendor, and rack space

Network bandwidth, firewall rules, and DNS settings

In Splunk, what is the primary purpose of organizing indexed data into buckets?

To replicate data across indexers to ensure high availability

To group data by time period, which facilitates lifecycle management and efficient search

To compress data to reduce disk usage and improve I/O performance

To encrypt data at rest and protect it from unauthorized access

SplunkEnterprise Certified Architect

Domain 1Objective 3

Size and Estimate Storage SPLK-2002 Practice Questions (Page 1)

Part of the Requirements and Infrastructure Planning domain, which makes up ~12% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)

12questions here

3free pages

5concepts

Questions 1–5

1foundation · easy
What happens to a bucket when it reaches the frozen state in a non-smart store deployment?
Select an answer first
2foundation · easy
When estimating storage for a non-smart store deployment, why is it important to account for index overhead (e.g., tsidx files) in addition to raw data?
Select an answer first
3foundation · easy
Which of the following is stored in a bucket's metadata (e.g., in the .meta file)?
Select an answer first
4foundation · easy
When planning storage for a Splunk indexer, which of the following factors must be considered?
Select an answer first
5foundation · easy
In Splunk, what is the primary purpose of organizing indexed data into buckets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.