A Splunk administrator notices that searches over a 30-day window are slow. The index has many small buckets. Which action will MOST directly improve search performance?

Increase the maximum number of warm buckets.

Increase the warm bucket size to consolidate data into fewer buckets.

Set the hot bucket to roll based on time instead of size.

Reduce the hot bucket size to create smaller buckets.

Which of the following is a key factor that influences storage sizing for a Splunk deployment?

The version of the Splunk Enterprise

The type of search head (standalone vs. clustered)

SplunkEnterprise Certified Architect

Domain 1Objective 3

Size and Estimate Storage SPLK-2002 Practice Questions (Page 2)

Part of the Requirements and Infrastructure Planning domain, which makes up ~12% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)

12questions here

3free pages

5concepts

Questions 6–10

6application · medium
A Splunk administrator notices that searches over a 30-day window are slow. The index has many small buckets. Which action will MOST directly improve search performance?
Select an answer first
7foundation · easy
Which of the following is a key factor that influences storage sizing for a Splunk deployment?
Select an answer first
8foundation · easy
An indexer receives 50 GB of raw data per day. The retention period is 30 days, and the replication factor is 2. What is the approximate total storage required for the raw data (ignoring overhead and compression)?
Select an answer first
9application · medium
A company ingests 120 GB/day of raw log data. They must retain data for 90 days in hot/warm storage and replicate everything to a second site with a replication factor of 2. Assuming a 50% compression ratio and 10% indexing overhead on the raw data, what is the minimum total hot/warm storage capacity needed across both sites?
Select an answer first
10expert · hard
A Splunk architect is designing a multi-site deployment. Site A ingests 600 GB/day, and Site B ingests 300 GB/day. Both sites replicate data to each other with a replication factor of 2. The retention period is 90 days. The compression ratio is 50%, and the indexing overhead is 10%. What is the total storage required at Site A?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Size and Estimate Storage SPLK-2002 Practice Questions (Page 2)

Questions 6–10

A Splunk administrator notices that searches over a 30-day window are slow. The index has many small buckets. Which action will MOST directly improve search performance?

Which of the following is a key factor that influences storage sizing for a Splunk deployment?

An indexer receives 50 GB of raw data per day. The retention period is 30 days, and the replication factor is 2. What is the approximate total storage required for the raw data (ignoring overhead and compression)?

Keep studying — Requirements and Infrastructure Planning