The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?

• A.host
• B.index
• C.linecount
• D.splunk_server

Comment: *

Name: *

Email: *

Verification: *

A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X, Y). During a search executed on search head X, indexer A crashes. What is Splunk's response?

• A.Update the user in Splunk web informing them that the results of their search may be incomplete.
• B.Repeat the search request on indexer B without informing the user.
• C.Update the user in Splunk web that their results may be incomple and that Splunk will try to re-execute the search.
• D.Inform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y.

Comment: *

Name: *

Email: *

Verification: *

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad- hoc and scheduled) on a single search head?

• A.Disk
• B.CPUs
• C.Memory
• D.Network interface cards

Comment: *

Name: *

Email: *

Verification: *

How does the Monitoring Console monitor forwarders?

• A.By pulling internal logs from forwarders.
• B.By using the forwarder monitoring add-on
• C.With internal logs forwarded by forwarders.
• D.With internal logs forwarded by deployment server.

Comment: *

Name: *

Email: *

Verification: *

When would the following command be used?

• A.To verify' the integrity of a local index.
• B.To verify the integrity of a SmartStore index.
• C.To verify the integrity of a SmartStore bucket.
• D.To verify the integrity of a local bucket.

Comment: *

Name: *

Email: *

Verification: *