Splunk SPLK-2002 Practice Exams
Last updated on Oct 07,2026- Exam Code: SPLK-2002
- Exam Name: Splunk Enterprise Certified Architect Exam
- Certification Provider: Splunk
- Latest update: Oct 07,2026
Question #101
Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one.
What are the items that must be evaluated before installing the add-on? (Select all that apply.)
- A . Identify number of scheduled or real-time searches.
- B . Validate if this Technical Add-On enables event data for a data model.
- C . Identify the maximum number of forwarders Technical Add-On can support.
- D . Verify if Technical Add-On needs to be installed onto both a search head or indexer.
Correct Answer: A, B
A, B
Explanation:
A Technical Add-On (TA) is a Splunk app that contains configurations for data collection, parsing, and enrichment. It can also enable event data for a data model, which is useful for creating dashboards and reports. Therefore, before installing a TA, it is important to identify the number of scheduled or real-time searches that will use the data model, and to validate if the TA enables event data for a data model. The number of forwarders that the TA can support is not relevant, as the TA is installed on the indexer or search head, not on the forwarder. The installation location of the TA depends on the type of data and the use case, so it is not a fixed requirement
A, B
Explanation:
A Technical Add-On (TA) is a Splunk app that contains configurations for data collection, parsing, and enrichment. It can also enable event data for a data model, which is useful for creating dashboards and reports. Therefore, before installing a TA, it is important to identify the number of scheduled or real-time searches that will use the data model, and to validate if the TA enables event data for a data model. The number of forwarders that the TA can support is not relevant, as the TA is installed on the indexer or search head, not on the forwarder. The installation location of the TA depends on the type of data and the use case, so it is not a fixed requirement
Question #102
Several critical searches that were functioning correctly yesterday are not finding a lookup table today.
Which log file would be the best place to start troubleshooting?
- A . btool.log
- B . web_access.log
- C . health.log
- D . configuration_change.log
Correct Answer: B
B
Explanation:
A lookup table is a file that contains a list of values that can be used to enrich or modify the data during search time1. Lookup tables can be stored in CSV files or in the KV Store1. Troubleshooting lookup tables involves identifying and resolving issues that prevent the lookup tables from being accessed, updated, or applied correctly by the Splunk searches. Some of the tools and methods that can help with troubleshooting lookup tables are:
web_access.log: This is a file that contains information about the HTTP requests and responses that occur between the Splunk web server and the clients2. This file can help troubleshoot issues related to lookup table permissions, availability, and errors, such as 404 Not Found, 403 Forbidden, or 500 Internal Server Error34.
btool output: This is a command-line tool that displays the effective configuration settings for a given Splunk component, such as inputs, outputs, indexes, props, and so on5. This tool can help troubleshoot issues related to lookup table definitions, locations, and precedence, as well as identify the source of a configuration setting6.
search.log: This is a file that contains detailed information about the execution of a search, such as the search pipeline, the search commands, the search results, the search errors, and the search performance. This file can help troubleshoot issues related to lookup table commands, arguments, fields, and outputs, such as lookup, inputlookup, outputlookup, lookup_editor, and so on .
Option B is the correct answer because web_access.log is the best place to start troubleshooting
lookup table issues, as it can provide the most relevant and immediate information about the lookup table access and status.
Option A is incorrect because btool output is not a log file, but a command-line tool.
Option C is incorrect because health.log is a file that contains information about the health of the Splunk components, such as the indexer cluster, the search head cluster, the license master, and the deployment server. This file can help troubleshoot issues related to Splunk deployment health, but not necessarily related to lookup tables.
Option D is incorrect because configuration_change.log is a file that contains information about the changes made to the Splunk configuration files, such as the user, the time, the file, and the action. This file can help troubleshoot issues related to Splunk configuration changes, but not necessarily related to lookup tables.
Reference: 1: About lookups – Splunk Documentation 2: web_access.log – Splunk Documentation 3: Troubleshoot lookups to the Splunk Enterprise KV Store 4: Troubleshoot lookups in Splunk Enterprise Security – Splunk Documentation 5: Use btool to troubleshoot configurations C Splunk Documentation 6: Troubleshoot configuration issues – Splunk Documentation : Use the search.log file – Splunk Documentation : Troubleshoot search-time field extraction – Splunk Documentation : [Troubleshoot lookups – Splunk Documentation] : [health.log – Splunk Documentation] : [configuration_change.log – Splunk Documentation]
B
Explanation:
A lookup table is a file that contains a list of values that can be used to enrich or modify the data during search time1. Lookup tables can be stored in CSV files or in the KV Store1. Troubleshooting lookup tables involves identifying and resolving issues that prevent the lookup tables from being accessed, updated, or applied correctly by the Splunk searches. Some of the tools and methods that can help with troubleshooting lookup tables are:
web_access.log: This is a file that contains information about the HTTP requests and responses that occur between the Splunk web server and the clients2. This file can help troubleshoot issues related to lookup table permissions, availability, and errors, such as 404 Not Found, 403 Forbidden, or 500 Internal Server Error34.
btool output: This is a command-line tool that displays the effective configuration settings for a given Splunk component, such as inputs, outputs, indexes, props, and so on5. This tool can help troubleshoot issues related to lookup table definitions, locations, and precedence, as well as identify the source of a configuration setting6.
search.log: This is a file that contains detailed information about the execution of a search, such as the search pipeline, the search commands, the search results, the search errors, and the search performance. This file can help troubleshoot issues related to lookup table commands, arguments, fields, and outputs, such as lookup, inputlookup, outputlookup, lookup_editor, and so on .
Option B is the correct answer because web_access.log is the best place to start troubleshooting
lookup table issues, as it can provide the most relevant and immediate information about the lookup table access and status.
Option A is incorrect because btool output is not a log file, but a command-line tool.
Option C is incorrect because health.log is a file that contains information about the health of the Splunk components, such as the indexer cluster, the search head cluster, the license master, and the deployment server. This file can help troubleshoot issues related to Splunk deployment health, but not necessarily related to lookup tables.
Option D is incorrect because configuration_change.log is a file that contains information about the changes made to the Splunk configuration files, such as the user, the time, the file, and the action. This file can help troubleshoot issues related to Splunk configuration changes, but not necessarily related to lookup tables.
Reference: 1: About lookups – Splunk Documentation 2: web_access.log – Splunk Documentation 3: Troubleshoot lookups to the Splunk Enterprise KV Store 4: Troubleshoot lookups in Splunk Enterprise Security – Splunk Documentation 5: Use btool to troubleshoot configurations C Splunk Documentation 6: Troubleshoot configuration issues – Splunk Documentation : Use the search.log file – Splunk Documentation : Troubleshoot search-time field extraction – Splunk Documentation : [Troubleshoot lookups – Splunk Documentation] : [health.log – Splunk Documentation] : [configuration_change.log – Splunk Documentation]
Question #103
On search head cluster members, where in $splunk_home does the Splunk Deployer deploy app content by default?
- A . etc/apps/
- B . etc/slave-apps/
- C . etc/shcluster/
- D . etc/deploy-apps/
Correct Answer: B
B
Explanation:
According to the Splunk documentation1, the Splunk Deployer deploys app content to the etc/slave-apps/ directory on the search head cluster members by default. This directory contains the apps that the deployer distributes to the members as part of the configuration bundle.
The other options are false because:
The etc/apps/ directory contains the apps that are installed locally on each member, not the apps that are distributed by the deployer2.
The etc/shcluster/ directory contains the configuration files for the search head cluster, not the apps that are distributed by the deployer3.
The etc/deploy-apps/ directory is not a valid Splunk directory, as it does not exist in the Splunk file system structure4.
B
Explanation:
According to the Splunk documentation1, the Splunk Deployer deploys app content to the etc/slave-apps/ directory on the search head cluster members by default. This directory contains the apps that the deployer distributes to the members as part of the configuration bundle.
The other options are false because:
The etc/apps/ directory contains the apps that are installed locally on each member, not the apps that are distributed by the deployer2.
The etc/shcluster/ directory contains the configuration files for the search head cluster, not the apps that are distributed by the deployer3.
The etc/deploy-apps/ directory is not a valid Splunk directory, as it does not exist in the Splunk file system structure4.
Question #104
How can internal logging levels in a Splunk environment be changed to troubleshoot an issue? (select all that apply)
- A . Use the Monitoring Console (MC).
- B . Use Splunk command line.
- C . Use Splunk Web.
- D . Edit log-local. cfg.
Correct Answer: ABCD
ABCD
Explanation:
Splunk provides various methods to change the internal logging levels in a Splunk environment to troubleshoot an issue. All of the options are valid ways to do so.
Option A is correct because the Monitoring Console (MC) allows the administrator to view and modify the logging levels of various Splunk components through a graphical interface.
Option B is correct because the Splunk command line provides the splunk set log-level command to change the logging levels of specific components or categories.
Option C is correct because the Splunk Web provides the Settings > Server settings > Server logging page to change the logging levels of various components through a web interface.
Option D is correct because the log-local.cfg file allows the administrator to manually edit the logging levels of various components by overriding the default settings in the log.cfg file123
1: https://docs.splunk.com/Documentation/Splunk/9.1.2/Troubleshooting/Enabledebuglogging 2: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Serverlogging 3: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Loglocalcfg
ABCD
Explanation:
Splunk provides various methods to change the internal logging levels in a Splunk environment to troubleshoot an issue. All of the options are valid ways to do so.
Option A is correct because the Monitoring Console (MC) allows the administrator to view and modify the logging levels of various Splunk components through a graphical interface.
Option B is correct because the Splunk command line provides the splunk set log-level command to change the logging levels of specific components or categories.
Option C is correct because the Splunk Web provides the Settings > Server settings > Server logging page to change the logging levels of various components through a web interface.
Option D is correct because the log-local.cfg file allows the administrator to manually edit the logging levels of various components by overriding the default settings in the log.cfg file123
1: https://docs.splunk.com/Documentation/Splunk/9.1.2/Troubleshooting/Enabledebuglogging 2: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Serverlogging 3: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Loglocalcfg
Question #105
To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?
- A . repFactor = 0
- B . replicate = 0
- C . repFactor = auto
- D . replicate = auto
Correct Answer: C
C
Explanation:
To activate replication for an index in an indexer cluster, the repFactor attribute must be configured in indexes.conf on all peer nodes. This attribute specifies the replication factor for the index, which determines how many copies of raw data are maintained by the cluster. Setting the repFactor attribute to auto will enable replication for the index. The replicate attribute in indexes.conf is not a valid Splunk attribute. The repFactor attribute in outputs.conf and the replicate attribute in deploymentclient.conf are not related to replication for an index in an indexer cluster. For more information, see Configure indexes for indexer clusters in the Splunk documentation.
C
Explanation:
To activate replication for an index in an indexer cluster, the repFactor attribute must be configured in indexes.conf on all peer nodes. This attribute specifies the replication factor for the index, which determines how many copies of raw data are maintained by the cluster. Setting the repFactor attribute to auto will enable replication for the index. The replicate attribute in indexes.conf is not a valid Splunk attribute. The repFactor attribute in outputs.conf and the replicate attribute in deploymentclient.conf are not related to replication for an index in an indexer cluster. For more information, see Configure indexes for indexer clusters in the Splunk documentation.
Question #106
Which Splunk internal index contains license-related events?
- A . _audit
- B . _license
- C . _internal
- D . _introspection
Correct Answer: C
C
Explanation:
The _internal index contains license-related events, such as the license usage, the license quota, the license pool, the license stack, and the license violations. These events are logged by the license manager in the license_usage.log file, which is part of the _internal index. The _audit index contains audit events, such as user actions, configuration changes, and search activity. These events are logged by the audit trail in the audit.log file, which is part of the _audit index. The _license index does not exist in Splunk, as the license-related events are stored in the _internal index. The _introspection index contains platform instrumentation data, such as the resource usage, the disk objects, the search activity, and the data ingestion. These data are logged by the introspection generator in various log files, such as resource_usage.log, disk_objects.log, search_activity.log, and data_ingestion.log, which are part of the _introspection index. For more information, see About Splunk Enterprise logging and [About the _internal index] in the Splunk documentation.
C
Explanation:
The _internal index contains license-related events, such as the license usage, the license quota, the license pool, the license stack, and the license violations. These events are logged by the license manager in the license_usage.log file, which is part of the _internal index. The _audit index contains audit events, such as user actions, configuration changes, and search activity. These events are logged by the audit trail in the audit.log file, which is part of the _audit index. The _license index does not exist in Splunk, as the license-related events are stored in the _internal index. The _introspection index contains platform instrumentation data, such as the resource usage, the disk objects, the search activity, and the data ingestion. These data are logged by the introspection generator in various log files, such as resource_usage.log, disk_objects.log, search_activity.log, and data_ingestion.log, which are part of the _introspection index. For more information, see About Splunk Enterprise logging and [About the _internal index] in the Splunk documentation.
Question #107
When should multiple search pipelines be enabled?
- A . Only if disk IOPS is at 800 or better.
- B . Only if there are fewer than twelve concurrent users.
- C . Only if running Splunk Enterprise version 6.6 or later.
- D . Only if CPU and memory resources are significantly under-utilized.
Correct Answer: D
D
Explanation:
Multiple search pipelines should be enabled only if CPU and memory resources are significantly under-utilized. Search pipelines are the processes that execute search commands and return results. Multiple search pipelines can improve the search performance by running concurrent searches in parallel. However, multiple search pipelines also consume more CPU and memory resources, which can affect the overall system performance. Therefore, multiple search pipelines should be enabled only if there are enough CPU and memory resources available, and if the system is not bottlenecked by disk I/O or network bandwidth. The number of concurrent users, the disk IOPS, and the Splunk Enterprise version are not relevant factors for enabling multiple search pipelines
D
Explanation:
Multiple search pipelines should be enabled only if CPU and memory resources are significantly under-utilized. Search pipelines are the processes that execute search commands and return results. Multiple search pipelines can improve the search performance by running concurrent searches in parallel. However, multiple search pipelines also consume more CPU and memory resources, which can affect the overall system performance. Therefore, multiple search pipelines should be enabled only if there are enough CPU and memory resources available, and if the system is not bottlenecked by disk I/O or network bandwidth. The number of concurrent users, the disk IOPS, and the Splunk Enterprise version are not relevant factors for enabling multiple search pipelines
Question #108
Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity.
Which of the following options will provide the most search performance improvement?
- A . Replace the indexer storage to solid state drives (SSD).
- B . Add more search heads and redistribute users based on the search type.
- C . Look for slow searches and reschedule them to run during an off-peak time.
- D . Add more search peers and make sure forwarders distribute data evenly across all indexers.
Correct Answer: D
D
Explanation:
Adding more search peers and making sure forwarders distribute data evenly across all indexers will provide the most search performance improvement when the distributed deployment is approaching its capacity. Adding more search peers will increase the search concurrency and reduce the load on each indexer. Distributing data evenly across all indexers will ensure that the search workload is balanced and no indexer becomes a bottleneck. Replacing the indexer storage to SSD will improve the search performance, but it is a costly and time-consuming option. Adding more search heads will not improve the search performance if the indexers are the bottleneck. Rescheduling slow searches to run during an off-peak time will reduce the search contention, but it will not improve the search performance for each individual search. For more information, see [Scale your indexer cluster] and [Distribute data across your indexers] in the Splunk documentation.
D
Explanation:
Adding more search peers and making sure forwarders distribute data evenly across all indexers will provide the most search performance improvement when the distributed deployment is approaching its capacity. Adding more search peers will increase the search concurrency and reduce the load on each indexer. Distributing data evenly across all indexers will ensure that the search workload is balanced and no indexer becomes a bottleneck. Replacing the indexer storage to SSD will improve the search performance, but it is a costly and time-consuming option. Adding more search heads will not improve the search performance if the indexers are the bottleneck. Rescheduling slow searches to run during an off-peak time will reduce the search contention, but it will not improve the search performance for each individual search. For more information, see [Scale your indexer cluster] and [Distribute data across your indexers] in the Splunk documentation.
Question #109
To expand the search head cluster by adding a new member, node2, what first step is required?
- A . splunk bootstrap shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey
- B . splunk init shcluster-config -master_uri https://node2:8089 -replication_port 9200 -secret supersecretkey
- C . splunk init shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey
- D . splunk add shcluster-member -new_member_uri https://node2:8089 -replication_port 9200 – secret supersecretkey
Correct Answer: C
C
Explanation:
To expand the search head cluster by adding a new member, node2, the first step is to initialize the cluster configuration on node2 using the splunk init shcluster-config command. This command sets the required parameters for the cluster member, such as the management URI, the replication port, and the shared secret key. The management URI must be unique for each cluster member and must match the URI that the deployer uses to communicate with the member. The replication port must be the same for all cluster members and must be different from the management port. The secret key must be the same for all cluster members and must be encrypted using the splunk_encrypt command. The master_uri parameter is optional and specifies the URI of the cluster captain. If not specified, the cluster member will use the captain election process to determine the captain.
Option C shows the correct syntax and parameters for the splunk init shcluster-config command.
Option A is incorrect because the splunk bootstrap shcluster-config command is used to bring up the first cluster member as the initial captain, not to add a new member.
Option B is incorrect because the master_uri parameter is not required and the mgmt_uri parameter is missing.
Option D is incorrect because the splunk add shcluster-member command is used to add an existing search head to the cluster, not to initialize a new member12 1:
https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/SHCdeploymentoverview#Initialize_cluster_members 2:
https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/SHCconfigurationdetails#Configure_the_cluster_members
C
Explanation:
To expand the search head cluster by adding a new member, node2, the first step is to initialize the cluster configuration on node2 using the splunk init shcluster-config command. This command sets the required parameters for the cluster member, such as the management URI, the replication port, and the shared secret key. The management URI must be unique for each cluster member and must match the URI that the deployer uses to communicate with the member. The replication port must be the same for all cluster members and must be different from the management port. The secret key must be the same for all cluster members and must be encrypted using the splunk_encrypt command. The master_uri parameter is optional and specifies the URI of the cluster captain. If not specified, the cluster member will use the captain election process to determine the captain.
Option C shows the correct syntax and parameters for the splunk init shcluster-config command.
Option A is incorrect because the splunk bootstrap shcluster-config command is used to bring up the first cluster member as the initial captain, not to add a new member.
Option B is incorrect because the master_uri parameter is not required and the mgmt_uri parameter is missing.
Option D is incorrect because the splunk add shcluster-member command is used to add an existing search head to the cluster, not to initialize a new member12 1:
https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/SHCdeploymentoverview#Initialize_cluster_members 2:
https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/SHCconfigurationdetails#Configure_the_cluster_members
Question #110
Which of the following most improves KV Store resiliency?
- A . Decrease latency between search heads.
- B . Add faster storage to the search heads to improve artifact replication.
- C . Add indexer CPU and memory to decrease search latency.
- D . Increase the size of the Operations Log.
Correct Answer: A
A
Explanation:
KV Store is a feature of Splunk Enterprise that allows apps to store and retrieve data within the context of an app1.
KV Store resides on search heads and replicates data across the members of a search head cluster1. KV Store resiliency refers to the ability of KV Store to maintain data availability and consistency in the event of failures or disruptions2.
One of the factors that affects KV Store resiliency is the network latency between search heads, which can impact the speed and reliability of data replication2.
Decreasing latency between search heads can improve KV Store resiliency by reducing the chances of data loss, inconsistency, or corruption2.
The other options are not directly related to KV Store resiliency. Faster storage, indexer CPU and memory, and Operations Log size may affect other aspects of Splunk performance, but not KV Store345.
Reference: 1: About the app key value store 2: Configure and deploy KV Store using Splunk Enterprise 3: Creating and CRUDing a KV Store in Splunk: Part 1 4: KV store troubleshooting tools 5: Solved: Re: Disabling KV store
A
Explanation:
KV Store is a feature of Splunk Enterprise that allows apps to store and retrieve data within the context of an app1.
KV Store resides on search heads and replicates data across the members of a search head cluster1. KV Store resiliency refers to the ability of KV Store to maintain data availability and consistency in the event of failures or disruptions2.
One of the factors that affects KV Store resiliency is the network latency between search heads, which can impact the speed and reliability of data replication2.
Decreasing latency between search heads can improve KV Store resiliency by reducing the chances of data loss, inconsistency, or corruption2.
The other options are not directly related to KV Store resiliency. Faster storage, indexer CPU and memory, and Operations Log size may affect other aspects of Splunk performance, but not KV Store345.
Reference: 1: About the app key value store 2: Configure and deploy KV Store using Splunk Enterprise 3: Creating and CRUDing a KV Store in Splunk: Part 1 4: KV store troubleshooting tools 5: Solved: Re: Disabling KV store