New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Splunk SPLK-2002 Exam - Topic 10 Question 105 Discussion

Actual exam question for Splunk's SPLK-2002 exam
Question #: 105
Topic #: 10
[All SPLK-2002 Questions]

Which of the following is true for indexer cluster knowledge bundles?

Show Suggested Answer Hide Answer
Suggested Answer: B

According to the Splunk documentation1, indexer cluster knowledge bundles are the configuration files that the cluster master distributes to the peer nodes as part of the cluster configuration bundle. The knowledge bundles contain the knowledge objects, such as event types, tags, lookups, and so on, that are relevant for indexing and searching the data. The cluster master creates the knowledge bundles by merging the app-name/default and app-name/local directories from the apps that reside on the master node.The cluster master then pushes the knowledge bundles to the peer nodes, where they reside under the $SPLUNK_HOME/var/run directory2. The other options are false because:

Only app-name/local is pushed. This is false because the cluster master pushes both the app-name/default and app-name/local directories, after merging them, to the peer nodes.The app-name/local directory contains the local customizations of the app configuration, while the app-name/default directory contains the default app configuration3.

Only app-name/default is pushed. This is false because the cluster master pushes both the app-name/default and app-name/local directories, after merging them, to the peer nodes.The app-name/default directory contains the default app configuration, while the app-name/local directory contains the local customizations of the app configuration3.

app-name/default and app-name/local are pushed without change. This is false because the cluster master merges the app-name/default and app-name/local directories before pushing them to the peer nodes.This ensures that the peer nodes have the latest and consistent configuration of the apps3.


by Dianne at Jan 14, 2025, 05:52 AM

Limited Time Offer

25%

Off

Get Premium SPLK-2002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Venita
3 months ago
D sounds off too, pushing without change seems unlikely.
upvoted 0 times
...
Mignon
3 months ago
C is definitely not right, only default doesn't cover it.
upvoted 0 times
...
Linwood
3 months ago
Wait, are we sure about that? I thought it was just A.
upvoted 0 times
...
Dierdre
4 months ago
Totally agree with B, makes the most sense!
upvoted 0 times
...
Chu
4 months ago
I think B is correct, they get merged before pushing.
upvoted 0 times
...
Louvenia
4 months ago
I’m leaning towards D, but I’m not entirely confident. I feel like there was a detail about how they are handled before pushing.
upvoted 0 times
...
Barney
4 months ago
I vaguely recall something about only pushing app-name/local, but that seems too simple for this question.
upvoted 0 times
...
Velda
4 months ago
I practiced a similar question where it was about merging configurations, so I feel like B might be the right answer here.
upvoted 0 times
...
Michal
5 months ago
I think I remember that both app-name/default and app-name/local are involved, but I'm not sure if they get merged or pushed separately.
upvoted 0 times
...
Andrew
5 months ago
This question is really throwing me for a loop. I'm not familiar with the concept at all, and none of the options are jumping out at me as the clear answer. I guess I'll have to make an educated guess and hope for the best.
upvoted 0 times
...
Selma
5 months ago
Okay, I think I've got a handle on this. Based on my understanding, the correct answer is option B - app-name/default and app-name/local are merged before pushing. I'm fairly confident in that, but I'll double-check my work just to be sure.
upvoted 0 times
...
Mollie
5 months ago
Hmm, this looks like a tricky one. I think I remember something about app-name/default and app-name/local, but I'm not sure how they're handled. I'll have to think it through and see if I can eliminate any of the options.
upvoted 0 times
...
Dona
5 months ago
I'm not too sure about this one. The question seems a bit confusing, and I'm not familiar with the concept of "indexer cluster knowledge bundles". I'll need to read through the options carefully and try to reason through it.
upvoted 0 times
...
Noah
1 year ago
Honestly, I'm just hoping the answer isn't 'all of the above' - that would be a cruel joke!
upvoted 0 times
Tashia
1 year ago
B) app-name/default and app-name/local are merged before pushing.
upvoted 0 times
...
Dominic
1 year ago
A) Only app-name/local is pushed.
upvoted 0 times
...
...
Svetlana
1 year ago
I'm not sure, but I think C) Only app-name/default is pushed makes sense too, as it simplifies the process.
upvoted 0 times
...
Torie
1 year ago
I agree with Lelia, because merging the knowledge bundles ensures that all configurations are included.
upvoted 0 times
...
Lelia
1 year ago
I think the answer is B) app-name/default and app-name/local are merged before pushing.
upvoted 0 times
...
Elina
1 year ago
C has got to be the right answer. Why would we push both bundles separately? That's just wasteful.
upvoted 0 times
...
Sharan
1 year ago
Hmm, I'm torn between B and D. Maybe I'll just flip a coin and hope for the best!
upvoted 0 times
Donette
1 year ago
Okay, let's choose B and see if we're right.
upvoted 0 times
...
Dong
1 year ago
Let's go with B then.
upvoted 0 times
...
Fabiola
1 year ago
I'm leaning towards D actually.
upvoted 0 times
...
Gearldine
1 year ago
I think B is the correct answer.
upvoted 0 times
...
...
Elena
1 year ago
I'm gonna go with B. Merging the default and local bundles makes sense before pushing them.
upvoted 0 times
...
Hershel
1 year ago
D seems like the correct answer to me. Why would we only push one of the bundles when we have both available?
upvoted 0 times
Kassandra
1 year ago
Exactly, pushing both bundles without any changes ensures that all the necessary knowledge is available in the indexer cluster.
upvoted 0 times
...
Merissa
1 year ago
I agree, D seems like the correct answer. It makes sense to push both bundles without any changes.
upvoted 0 times
...
Maybelle
1 year ago
D) app-name/default and app-name/local are pushed without change.
upvoted 0 times
...
Carla
1 year ago
C) Only app-name/default is pushed.
upvoted 0 times
...
Marcos
1 year ago
B) app-name/default and app-name/local are merged before pushing.
upvoted 0 times
...
Felicitas
1 year ago
A) Only app-name/local is pushed.
upvoted 0 times
...
...

Save Cancel