A search head has been configured to connect to a single-site indexer cluster. The search head can search the cluster, but it does not have access to the latest configuration changes that were pushed to the peers. What is the MOST likely reason?

The search head needs to be restarted to pick up the new configuration

The search head's distributed search configuration is incorrect

The master node's bundle push did not include the search head

The search head is not part of the cluster bundle

An architect is designing a single-site indexer cluster. The cluster will have 3 peers, 1 master, and 2 search heads. Which statement correctly describes the role of the master node in this architecture?

The master node serves search requests from search heads

The master node indexes data and replicates it to peers

The master node manages the cluster and coordinates replication, but does not index data

The master node stores a copy of all data for backup

Which of the following is a prerequisite for configuring a single-site indexer cluster in Splunk Enterprise?

A dedicated license master separate from the cluster master

A dedicated management network separate from the data network

All peer nodes must have identical hardware specifications

A valid Splunk Enterprise license that covers the total daily indexing volume of all peers

What is the cluster bundle in a Splunk indexer cluster?

A set of replicated buckets stored on each peer

A backup of the master node's index data

A log of all cluster replication events

A collection of configuration files and apps that are distributed to peer nodes

SplunkEnterprise Certified Architect

Domain 3Objective 1

Splunk Single-Site Indexer Cluster Configuration SPLK-2002 Practice Questions (Page 1)

Part of the Indexer Clustering domain, which makes up ~25% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–15 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

9concepts

Questions 1–5

1expert · hard
A search head has been configured to connect to a single-site indexer cluster. The search head can search the cluster, but it does not have access to the latest configuration changes that were pushed to the peers. What is the MOST likely reason?
Select an answer first
2application · medium
An architect is designing a single-site indexer cluster. The cluster will have 3 peers, 1 master, and 2 search heads. Which statement correctly describes the role of the master node in this architecture?
Select an answer first
3foundation · easy
Which of the following is a prerequisite for configuring a single-site indexer cluster in Splunk Enterprise?
Select an answer first
4foundation · easy
What is the cluster bundle in a Splunk indexer cluster?
Select an answer first
5foundation · easy
In a single-site indexer cluster, which component is responsible for coordinating the replication of buckets and managing the overall cluster state?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.