A Splunk admin needs to change the TCP input port on a universal forwarder from 9997 to 9998. The admin wants to make the change using the CLI and ensure it is applied immediately. Which command should the admin run?

Edit `outputs.conf` and restart the forwarder.

`./splunk add forward-server 9998 -auth admin:pass`

`./splunk edit tcp -port 9998 -auth admin:pass`

`./splunk set default-port 9998 -auth admin:pass`

In a Splunk distributed environment, how are configuration changes typically propagated to forwarders?

Through the indexer cluster master

By manually copying files to each forwarder

Using the search head to push configurations

When the same setting appears in multiple configuration files, which file takes precedence in Splunk?

The file in the system directory

The file with the highest precedence according to the directory hierarchy (system < app < user)

SplunkEnterprise Certified Architect

Domain 2Objective 4

Understand Configuration Management for All Splunk Components, Using SPLK-2002 Practice Questions (Page 4)

Part of the Clustering and Deployment Architecture domain, which makes up ~20% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

7concepts

7 Concepts in This Objective

Configuration management overview
Configuration file types and precedence
Configuration directories and apps
Using the CLI for configuration
Using configuration files for settings
Configuration deployment and propagation
Troubleshooting configuration issues

Questions 16–19

16foundation · easy
In Splunk, which configuration file type is used to define settings such as indexes, inputs, and outputs?
Select an answer first
17application · medium
A Splunk admin needs to change the TCP input port on a universal forwarder from 9997 to 9998. The admin wants to make the change using the CLI and ensure it is applied immediately. Which command should the admin run?
Select an answer first
18foundation · easy
In a Splunk distributed environment, how are configuration changes typically propagated to forwarders?
Select an answer first
19foundation · easy
When the same setting appears in multiple configuration files, which file takes precedence in Splunk?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Understand Configuration Management for All Splunk Components, Using SPLK-2002 Practice Questions (Page 4)

Questions 16–19

In Splunk, which configuration file type is used to define settings such as indexes, inputs, and outputs?

A Splunk admin needs to change the TCP input port on a universal forwarder from 9997 to 9998. The admin wants to make the change using the CLI and ensure it is applied immediately. Which command should the admin run?

In a Splunk distributed environment, how are configuration changes typically propagated to forwarders?

When the same setting appears in multiple configuration files, which file takes precedence in Splunk?

Keep studying — Clustering and Deployment Architecture