SPLK-2002 無料問題集「Splunk Enterprise Certified Architect」

（A）Average size of event data.

（B）Number of concurrent searches on data.

（C）Peak data rates.

（D）Number of data sources.

（A）Search heads

（B）Search peers

（C）Deployment clients

（D）There are no roles that require the license manager to scale

（A）splunk offline -f

（B）splunk decommission --enforce counts

（C）splunk stop -f

（D）splunk offline --enforce-counts

（A）Manages alert action suppressions (throttling).

（B）Is the job scheduler for the entire SHC.

（C）Synchronizes the member list with the KV store primary.

（D）Replicates the SHC's knowledge bundle to the search peers.

（A）License server.

（B）Deployment layer.

（C）Search head layer.

（D）Indexing layer.

（A）Use TCP syslog.

（B）Use one or more syslog servers to persist data with a Universal Forwarder to send the data to Splunk indexers.

（C）Use a network load balancer to direct syslog traffic to active backend syslog listeners.

（D）Configure UDP inputs on each Splunk indexer to receive data directly.

（A）main

（B）_internal

（C）_telemetry

（D）_introspection

（A）Data volume

（B）Data location

（C）Data format

（D）Data retention

（A）All peer nodes must run exactly the same Splunk version.

（B）The search head must run the same or a later Splunk version than the peer nodes.

（C）The master node must run the same or a later Splunk version than search heads.

（D）The peer nodes must run the same or a later Splunk version than the master node.

（A）source

（B）component

（C）channel

（D）sourcetype