Splunk SPLK-3003 問題集

質問 1：
A customer wants to understand how Splunk bucket types (hot, warm, cold) impact search performance within their environment. Their indexers have a single storage device for all data.
What is the proper message to communicate to the customer?
A. Because the cold buckets are written to a cheaper/slower storage volume, they will be slower to search compared to hot and warm buckets which are written to Solid State Disk (SSD).
B. Searching hot and warm buckets result in best performance because by default the cold buckets are miniaturized by removing TSIDX files to save on storage cost.
C. The bucket types (hot, warm, or cold) have the same search performance characteristics within the customer's environment.
D. While hot, warm, and cold buckets have the same search performance characteristics within the customers environment, due to their optimized structure, the thawed buckets are the most performant.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
When adding a new search head to a search head cluster (SHC), which of the following scenarios occurs?
A. The new search head connects to the deployer and replays any recent configuration changes to bring it up to date.
B. The new search head connects to the deployer and pulls the most recently deployed bundle. It then connects to the captain and replays any recent configuration changes to bring it up to date.
C. The new search head connects to the captain and replays any recent configuration changes to bring it up to date.
D. The new search head connects to the captain and pulls the most recently deployed bundle. It then connects to the deployer and replays any recent configuration changes to bring it up to date.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?
A. Remove the site from the list of available sites and create an alias for where the new data should be sent.
B. Remove the site from the list of available sites.
C. Create an alias for where the new data should be sent.
D. Nothing. Decommissioning a site is not possible.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Which configuration item should be set to false to significantly improve data ingestion performance?
A. SHOULD_LINEMERGE
B. AUTO_KV_JSON
C. ANNOTATE_PUNCT
D. BREAK_ONLY_BEFORE_DATE
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Which of the following server.conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?
A.

B.

C.

D.

正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A customer has a multisite cluster (two sites, each site in its own data center) and users experiencing a slow response when searches are run on search heads located in either site. The Search Job Inspector shows the delay is being caused by search heads on either site waiting for results to be returned by indexers on the opposing site. The network team has confirmed that there is limited bandwidth available between the two data centers, which are in different geographic locations.
Which of the following would be the least expensive and easiest way to improve search performance?
A. Set the site setting on each indexer in the server.conf clustering stanza to be the same for all indexers regardless of site.
B. Configure site_search_factor to ensure a searchable copy exists in the local site for each search head.
C. Move all indexers and search heads in one of the data centers into the same site.
D. Install a network pipe with more bandwidth between the two data centers.
正解：B
解説: (Topexam メンバーにのみ表示されます)