Free Splunk SPLK-2002 Exam Dumps August 2026

The splunk validate cluster-bundle --check-restart command is the officially documented Splunk Enterprise method to determine if a configuration bundle push will trigger a rolling restart within an indexer cluster.

When configuration changes are made on the Cluster Manager (Master Node)---for example, updates to indexes.conf, props.conf, or transforms.conf---Splunk administrators must validate the bundle before pushing it to all peer nodes. Using this command allows the Cluster Manager to simulate the deployment and verify whether the configuration modifications necessitate a restart across peer indexers to take effect.

The --check-restart flag specifically reports whether:

The configuration changes are minor (no restart required).

The changes affect components that require a full or rolling restart (e.g., changes to indexing paths, volume definitions, or replication factors).

Running this validation prior to an actual splunk apply cluster-bundle command prevents service disruption during production operations.

Other commands such as splunk show cluster-bundle-status display deployment status but not restart requirements, and splunk apply cluster-bundle executes the actual deployment, not validation.

Reference (Splunk Enterprise Documentation):

* Indexer Clustering: Deploy Configuration Bundles with Validation

* splunk validate cluster-bundle Command Reference

* Managing Indexer Clusters -- Rolling Restarts and Bundle Deployment Best Practices

* Splunk Enterprise Admin Manual -- Cluster Manager Maintenance Commands

The following logs are included in the _introspection index, which contains data that the Splunk Enterprise deployment logs for platform instrumentation:

disk_objects.log. This log contains information about the disk objects that Splunk creates and manages, such as buckets, indexes, and files. This log can help monitor the disk space usage and the bucket lifecycle.

resource_usage.log. This log contains information about the resource usage of Splunk processes, such as CPU, memory, disk, and network. This log can help monitor the Splunk performance and identify any resource bottlenecks. The following logs are not included in the _introspection index, but rather in the _internal index, which contains data that Splunk generates for internal logging:

audit.log. This log contains information about the audit events that Splunk records, such as user actions, configuration changes, and search activity. This log can help audit the Splunk operations and security.

metrics.log. This log contains information about the performance metrics that Splunk collects, such as data throughput, data latency, search concurrency, and search duration. This log can help measure the Splunk performance and efficiency. For more information, seeAbout Splunk Enterprise loggingand [About the _introspection index] in the Splunk documentation.

When adding or decommissioning a member from a Search Head Cluster (SHC), the proper order of operations is:

Delete Splunk Enterprise, if it exists.

Install and initialize the instance.

Join the SHC.

This order of operations ensures that the member has a clean and consistent Splunk installation before joining the SHC. Deleting Splunk Enterprise removes any existing configurations and data from the instance. Installing and initializing the instance sets up the Splunk software and the required roles and settings for the SHC. Joining the SHC adds the instance to the cluster and synchronizes the configurations and apps with the other members. The other order of operations are not correct, because they either skip a step or perform the steps in the wrong order.

The following may explain the problem of why a colleague cannot see the src_ip field in their search results: The field was extracted as a private knowledge object, and the colleague did not explicitly use the field in the search and the search was set to Fast Mode. A knowledge object is a Splunk entity that applies some knowledge or intelligence to the data, such as a field extraction, a lookup, or a macro. A knowledge object can have different permissions, such as private, app, or global. A private knowledge object is only visible to the user who created it, and it cannot be shared with other users. A field extraction is a type of knowledge object that extracts fields from the raw data at index time or search time. If a field extraction is created as a private knowledge object, then only the user who created it can see the extracted field in their search results. A search mode is a setting that determines how Splunk processes and displays the search results, such as Fast, Smart, or Verbose. Fast mode is the fastest and most efficient search mode, but it also limits the number of fields and events that are displayed. Fast mode only shows the default fields, such as _time, host, source, sourcetype, and _raw, and any fields that are explicitly used in the search. If a field is not used in the search and it is not a default field, then it will not be shown in Fast mode. The events are tagged as communicate, but are missing the network tag, and the Typing Queue, which does regular expression replacements, is blocked, are not valid explanations for the problem. Tags are labels that can be applied to fields or field values to make them easier to search. Tags do not affect the visibility of fields, unless they are used as filters in the search. The Typing Queue is a component of the Splunk data pipeline that performs regular expression replacements on the data, such as replacing IP addresses with host names.The Typing Queue does not affect the field extraction process, unless it is configured to do so

When using ingest-based licensing, there are no Splunk roles that require the license manager to scale, because the license manager does not need to handle any additional load or complexity. Ingest-based licensing is a new licensing model that allows customers to pay for the data they ingest into Splunk, regardless of the data source, volume, or use case. Ingest-based licensing simplifies the licensing process and eliminates the need for license pools, license stacks, license slaves, and license warnings. The license manager is still responsible for enforcing the license quota and generating license usage reports, but it does not need to communicate with any other Splunk instances or monitor their license usage. Therefore, option C is the correct answer. Option A is incorrect because search peers are indexers that participate in a distributed search. They do not affect the license manager's scalability, because they do not report their license usage to the license manager. Option B is incorrect because search heads are Splunk instances that coordinate searches across multiple indexers. They do not affect the license manager's scalability, because they do not report their license usage to the license manager. Option D is incorrect because deployment clients are Splunk instances that receive configuration updates and apps from a deployment server.They do not affect the license manager's scalability, because they do not report their license usage to the license manager12

1: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/AboutSplunklicensing2: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/HowSplunklicensingworks

Splunk Enterprise uses the _audit index to log and store all user activity and audit-related information. This includes details such as user logins, searches executed, configuration changes, role modifications, and app management actions.

The _audit index is populated by data collected from the Splunkd audit logger and records actions performed through both Splunk Web and the CLI. Each event in this index typically includes fields like user, action, info, search_id, and timestamp, allowing administrators to track activity across all Splunk users and components for security, compliance, and accountability purposes.

The _internal index, by contrast, contains operational logs such as metrics.log and scheduler.log used for system performance and health monitoring. _kvstore stores internal KV Store metadata, and _telemetry is used for optional usage data reporting to Splunk.

The _audit index is thus the authoritative source for user behavior monitoring within Splunk environments and is a key component of compliance and security auditing.

Reference (Splunk Enterprise Documentation):

* Audit Logs and the _audit Index -- Monitoring User Activity

* Splunk Enterprise Security and Compliance: Tracking User Actions

* Splunk Admin Manual -- Overview of Internal Indexes (_internal, _audit, _introspection)

* Splunk Audit Logging and User Access Monitoring

When planning a search head cluster, the following statement is true: All indexers must belong to the underlying indexer cluster (no standalone indexers). A search head cluster is a group of search heads that share configurations, apps, and search jobs. A search head cluster requires an indexer cluster as its data source, meaning that all indexers that provide data to the search head cluster must be members of the same indexer cluster. Standalone indexers, or indexers that are not part of an indexer cluster, cannot be used as data sources for a search head cluster. All search heads do not have to use the same operating system, as long as they are compatible with the Splunk version and the indexer cluster. All search heads do not have to be members of the cluster, as standalone search heads can also search the indexer cluster, but they will not have the benefits of configuration replication and load balancing. The search head captain does not have to be assigned to the largest search head in the cluster, as the captain is dynamically elected from among the cluster members based on various criteria, such as CPU load, network latency, and search load.