NO.31 Which index-time props.confattributes impact indexing performance? (Select all that apply.)

NO.32 When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of
operations?

NO.33 Which command will permanently decommission a peer node operating in an indexer cluster?

NO.34 To reduce the captain’s work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

NO.35 A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering]
mode = master
replication_factor = 2
pass4SymmKey = password123
Which of the following statements describe this Splunk instance? (Select all that apply.)

NO.36 As a best practice, where should the internal licensing logs be stored?

NO.37 When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

NO.38 Which of the following should be included in a deployment plan?

NO.39 What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

NO.40 What is a Splunk Job? (Select all that apply.)

NO.41 When should multiple search pipelines be enabled?

NO.42 A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

NO.43 Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

NO.44 Which server.confattribute should be added to the master node’s server.conffile when
decommissioning a site in an indexer cluster?

NO.45 Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

NO.46 Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

NO.47 Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

NO.48 Which of the following is a best practice to maximize indexing performance?

NO.49 What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)