SPLK-2002 — Splunk Enterprise Certified Architect
Splunk

Splunk Enterprise Certified Architect (SPLK-2002) Practice Questions

★★★★★★ 4.6 125 verified reviews
125 questions
June 17, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Introduction (2%)
  • Project Requirements (5%)
  • Infrastructure Planning — Index Design (5%)
  • Infrastructure Planning — Resource Planning (7%)
  • Clustering Overview (5%)
  • Forwarder and Deployment Best Practices (6%)
  • Performance Monitoring and Tuning (5%)
  • Splunk Troubleshooting Methods and Tools (5%)
  • Clarifying the Problem (5%)
  • Licensing and Crash Problems (5%)
  • Configuration Problems (5%)
  • Search Problems (5%)
  • Deployment Problems (5%)
  • Large-scale Splunk Deployment Overview (5%)
  • Single-site Indexer Cluster (5%)
  • Multisite Indexer Cluster (5%)
  • Indexer Cluster Management & Admin (7%)
  • Search Head Cluster (5%)
  • Search Head Cluster Management & Admin (5%)
  • KV Store Collection & Lookup Management (3%)

Sample Questions (13 of 125 shown)

Q1 Introduction (2%)
Which of the following should be included in a deployment plan?
  1. A list of all vendor software licenses
  2. A comprehensive list of stakeholders, either direct or indirect
  3. The complete source code of all custom apps
  4. The personal contact information of all end users
✓ Correct Answer: B
A deployment plan should include a comprehensive list of stakeholders, either direct or indirect, who will be affected by or have input into the Splunk deployment. This ensures proper communication, requirement gathering, and alignment with business objectives throughout the deployment process.
Q2 Introduction (2%)
In the deployment planning process, when should a person identify who gets to see network data?
  1. Deployment schedule
  2. Topology diagramming
  3. Data source inventory
  4. Data policy definition
✓ Correct Answer: D
Identifying who gets to see network data should occur during the data policy definition phase of deployment planning. Data policy definition involves establishing rules about data access, retention, and security, including determining which users or roles have permission to view specific types of data such as network data.
Q3 Introduction (2%)
Describe a deployment plan in the context of a Splunk Enterprise implementation.
  1. A list of hardware specifications required for the deployment
  2. A comprehensive document outlining the strategy, timeline, resources, and processes for implementing Splunk Enterprise
  3. A configuration file that defines indexer cluster settings
  4. A training schedule for end users of the Splunk platform
✓ Correct Answer: B
A deployment plan in the context of Splunk Enterprise is a comprehensive document that outlines the strategy, timeline, resources, and processes required to implement a Splunk deployment successfully. It covers stakeholder identification, requirement gathering, infrastructure planning, data source onboarding, configuration management, and operational considerations.
Q4 Project Requirements (5%)
What information is needed about the current environment before deploying Splunk? (Select all that apply.)
  1. List of vendors for network devices
  2. Overall goals for the deployment
  3. Key users
  4. Data sources
✓ Correct Answer: B, C, D
Before deploying Splunk, it is essential to understand the overall goals for the deployment, identify key users who will interact with the system, and catalog all data sources that will feed into Splunk. Knowing the list of vendors for network devices is less critical than understanding the business objectives, user base, and data inputs that will drive the deployment architecture and sizing.
Q5 Project Requirements (5%)
When planning user management for a new Splunk deployment, which task can be disregarded?
  1. Determine the number of users present in Splunk log events
  2. Identify users authenticating with Splunk using LDAP or SAML
  3. Identify users authenticating with Splunk native authentication
  4. Determine the capabilities users need within the Splunk environment
✓ Correct Answer: A
Determining the number of users present in Splunk log events is not a relevant task for user management planning. The focus should be on identifying authentication methods (LDAP, SAML, or native), and determining the capabilities and roles users need within the Splunk environment.
Q6 Project Requirements (5%)
Identify critical information about the environment, volume, users, and requirements during the project requirements phase.
  1. The brand of network switches in use
  2. Daily data ingestion volume, number of users, search types, and data retention requirements
  3. The version of the operating system on end-user workstations
  4. The office locations of all stakeholders
✓ Correct Answer: B
During the project requirements phase, it is critical to gather information about daily data ingestion volume (affects licensing and storage), number of users (affects search head capacity), types of searches (affects performance planning), and data retention requirements (affects storage sizing and index design).
Q7 Project Requirements (5%)
Which of the following should be identified during the project requirements gathering phase for a Splunk deployment?
  1. The specific make and model of servers to be used
  2. The data sources, volume estimates, user count, and use cases
  3. The brand of monitoring software currently in use
  4. The color scheme of the Splunk Web interface
✓ Correct Answer: B
During project requirements gathering, key items to identify include data sources (what data will be ingested), volume estimates (how much data per day), user count (how many people will search), and use cases (security, IT operations, business analytics). These factors directly influence the architecture and sizing of the Splunk deployment.
Q8 Project Requirements (5%)
A company is planning a new Splunk Enterprise deployment. Which requirement is MOST important to determine the appropriate license type?
  1. Number of concurrent users
  2. Daily ingest volume in GB
  3. Number of indexers
  4. Types of data sources
✓ Correct Answer: B
Splunk licensing is based on daily indexing volume measured in gigabytes (GB). The daily ingest volume is the single most important factor in determining the appropriate license type and size. While other factors like user count and data sources are relevant for architecture planning, the license is directly tied to indexing volume.
Q9 Project Requirements (5%)
During the project requirements phase, which checklists and resources should be used to aid in collecting requirements?
  1. The Splunk Deployment Methodology checklist and capacity planning worksheets
  2. The MySQL administration guide
  3. The network topology diagram from the IT department
  4. The annual budget report
✓ Correct Answer: A
Splunk provides a Deployment Methodology that includes checklists and capacity planning worksheets to help collect deployment requirements. These resources guide architects through a systematic process of gathering information about data sources, volume, users, search types, retention policies, and infrastructure needs.
Q10 Infrastructure Planning: Index Design (5%)
When designing the number and size of indexes, which of the following considerations should be applied?
  1. Expected daily ingest volume, access controls, number of concurrent users
  2. Number of installed apps, expected daily ingest volume, data retention time policies
  3. Data retention time policies, number of installed apps, access controls
  4. Expected daily ingest volumes, data retention time policies, access controls
✓ Correct Answer: D
When designing the number and size of indexes, the key considerations are expected daily ingest volumes (determining storage sizing), data retention time policies (determining how long data is kept), and access controls (determining who can access specific indexed data). The number of concurrent users is more relevant to search head sizing, not index design.
Q11 Infrastructure Planning: Index Design (5%)
The guidance Splunk gives for estimating size on disk for syslog data is 50% of original data size. How does this divide between files in the index?
  1. rawdata is: 15%, tsidx is: 35%
  2. rawdata is: 35%, tsidx is: 15%
  3. rawdata is: 25%, tsidx is: 25%
  4. rawdata is: 10%, tsidx is: 40%
✓ Correct Answer: A
For syslog data, Splunk estimates that the on-disk storage is approximately 50% of the original data size. Within the index buckets, the rawdata consumes about 15% and the tsidx (index files) consumes about 35% of the original data size. This distribution is important for storage capacity planning.
Q12 Infrastructure Planning: Index Design (5%)
What is the expected minimum amount of storage required for data across an indexer cluster with the following input and parameters?
  • Raw data = 15 GB per day
  • Index files = 35 GB per day
  • Replication Factor (RF) = 2
  • Search Factor (SF) = 2
  1. 85 GB per day
  2. 50 GB per day
  3. 100 GB per day
  4. 65 GB per day
✓ Correct Answer: C
Total indexed data per day = Raw data (15 GB) + Index files (35 GB) = 50 GB. With RF = 2, each bucket is stored twice: 50 GB × 2 = 100 GB. SF = 2 means two searchable copies, but since RF ≥ SF, the replication copies already account for searchable copies. Total = 50 GB × RF(2) = 100 GB per day.
Q13 Infrastructure Planning: Index Design (5%)
Understand the design and sizing of indexes. Which factor determines the maximum number of buckets per index?
  1. The maxTotalDataSizeMB setting in indexes.conf
  2. The number of CPU cores on the indexer
  3. The amount of RAM allocated to Splunk
  4. The network bandwidth between indexers
✓ Correct Answer: A
The maxTotalDataSizeMB setting in indexes.conf determines the maximum total size of an index. When this size is reached, the oldest buckets are frozen (archived or deleted) based on the frozenTimePeriodInSecs setting. This is the primary mechanism for controlling the size and number of buckets per index.

You've viewed 3 of 125 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

At the pinnacle of the Splunk certification ladder, the Splunk Enterprise Certified Architect (SPLK-2002) credential validates your ability to design, deploy, and troubleshoot large-scale distributed Splunk environments with indexer clusters, search head clusters, and multisite replication. Administered through Pearson VUE, this 90-minute exam requires a scaled passing score of 700/1000 and mandates both an active Splunk Core Certified Power User (SPLK-1002) and Splunk Enterprise Certified Admin (SPLK-1003) certification as prerequisites.

To register, candidates must also complete the Architecting Splunk Enterprise Deployments, Troubleshooting Splunk Enterprise, and Splunk Enterprise Cluster Administration courses on the STEP portal, plus pass the rigorous Splunk Enterprise Deployment Practical Lab — a multi-day hands-on lab assessment. Splunk recommends at least 6 to 12 months of active experience designing and troubleshooting distributed Splunk architectures in enterprise environments, paired with deep familiarity with the Capacity Planning Manual, Managing Indexers and Clusters of Indexers, and Admin Manual.

The SPLK-2002 blueprint spans 20 domains covering the full architect lifecycle. Heavy-weight areas include Resource Planning (7%) with IOPS and storage sizing for Enterprise Security and ITSI, Indexer Cluster Management & Admin (7%) including peer offline states and decommissioning, Forwarder and Deployment Best Practices (6%) with Heavy vs. Universal Forwarder tiers, and Multisite Indexer Cluster (5%) testing site replication factors ($SRF$) and site search factors ($SSF$). Foundational troubleshooting domains cover btool, splunkd.log, and internal indexes for configuration debug (5%) plus the Job Inspector for search performance bottlenecks (5%).

For candidates preparing for the SPLK-2002 exam, our practice materials cover all 20 domains in the same proportions as the real test — from Project Requirements collection and Index Design with SmartStore storage estimation through Resource Planning with IOPS/capacity calculations and Enterprise Security sizing, Clustering Overview with Search Head Cluster foundational requirements, Forwarder tier design with Deployment Server configuration management, Performance Monitoring via limits.conf and props.conf tuning, Troubleshooting with btool, diag files, and internal indexes (_internal, _introspection), Licensing and Crash diagnosis, Configuration debug with file precedence layouts, Search problem isolation using the Job Inspector, Single-site and Multisite Indexer Clusters with $SRF$/$SSF$ factors, Indexer Cluster Management with peer offline and decommission workflows, Search Head Cluster captaincy and Deployer configuration, and KV Store replication and lookup synchronization. Each online practice question includes a detailed answer explanation that walks through the architectural reasoning and cluster mechanics, while the downloadable PDF packages the same question bank for offline review during commutes or in environments without stable internet.

Start your free SPLK-2002 practice test today and master distributed Splunk architecture, clustering, and troubleshooting.

Official Exam Domains & Weighting

To successfully pass the SPLK-2002 exam, candidates must master the following core domains:
  • Domain 1: Introduction (2%) — Describing a deployment plan and defining the deployment process phases.
  • Domain 2: Project Requirements (5%) — Identifying critical information about environment, volume, users, and business requirements, and applying checklists to collect requirements.
  • Domain 3: Infrastructure Planning — Index Design (5%) — Designing and sizing indexes, estimating non-SmartStore storage requirements, and identifying relevant app impact.
  • Domain 4: Infrastructure Planning — Resource Planning (7%) — Sizing considerations for disk IOPS and capacity, reference hardware for Splunk components, Enterprise Security/ITSI topology, and security/integrity measures.
  • Domain 5: Clustering Overview (5%) — Understanding non-SmartStore storage/disk usage in clusters and Search Head Clustering (SHC) foundational requirements.
  • Domain 6: Forwarder and Deployment Best Practices (6%) — Designing forwarder tiers (Heavy vs. Universal, load balancing) and managing configuration via Deployment Server.
  • Domain 7: Performance Monitoring and Tuning (5%) — Optimizing performance via limits.conf, managing bucket sizing in indexes.conf, tuning props.conf for event breaking/timestamping, and search performance optimization.
  • Domain 8: Splunk Troubleshooting Methods and Tools (5%) — Using diagnostic resources (diag files) and native system tools.
  • Domain 9: Clarifying the Problem (5%) — Tracking issues via btool, splunkd.log, and identifying internal indexes (_internal, _introspection).
  • Domain 10: Licensing and Crash Problems (5%) — Diagnosing license violations, pool alerts, master setup issues, and crash symptoms/dumps.
  • Domain 11: Configuration Problems (5%) — Debugging inputs configuration, stanza syntax flaws, and file precedence layouts.
  • Domain 12: Search Problems (5%) — Pinpointing slow or stuck searches and using the Job Inspector to find performance bottlenecks.
  • Domain 13: Deployment Problems (5%) — Troubleshooting data forwarding discrepancies and client-to-Deployment Server connectivity issues.
  • Domain 14: Large-scale Splunk Deployment Overview (5%) — Understanding server roles within clusters and managing License Master in highly available or clustered topologies.
  • Domain 15: Single-site Indexer Cluster (5%) — Configuring and spinning up single-site indexer clusters with Manager, Peer, and Search Head nodes.
  • Domain 16: Multisite Indexer Cluster (5%) — Configuring multi-site topologies with site replication factors ($SRF$), site search factors ($SSF$), and cluster migration/upgrade paths.
  • Domain 17: Indexer Cluster Management & Admin (7%) — Managing storage utilization, handling peer offline states and decommissioning, and master app bundle pushes.
  • Domain 18: Search Head Cluster (5%) — Deploying and configuring a dynamic Search Head Cluster (SHC) architecture.
  • Domain 19: Search Head Cluster Management & Admin (5%) — Using the Deployer to push configurations, managing captaincy transfer, and adding/decommissioning cluster members.
  • Domain 20: KV Store Collection & Lookup Management (3%) — Handling KV Store replication and lookup synchronization across clustered nodes.

What Our Customers Say 125 verified reviews

4.6 ★★★★★★ Based on 125 reviews
★★★★★★
The progress tracking feature for SPLK-2002 really motivated me. Seeing my improvement over time was incredibly satisfying.
— Daniel H.
★★★★★★
The way the SPLK-2002 questions are broken down by domain is great. Let me focus on my weak spots without wasting time.
— Olivia H.
★★★★★
Ended up buying three different SPLK-2002 prep resources and this was by far the most helpful one. Don’t waste money on others.
— Penelope W.
★★★★★★
Used the SPLK-2002 test bank for two weeks before my exam date. Felt very prepared going in and the results showed.
— Luke M.
★★★★★★
I bought access for the SPLK-2002 exam as a gift for my brother. He passed on his first try and said the questions were spot-on.
— Cameron J.
★★★★★★
Honestly, I wouldn’t have passed SPLK-2002 without these. The explanations actually teach you instead of just giving the answer.
— Jordan P.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Unlike lower-level exams, SPLK-2002 tests configuration precedence (btool), hardware math calculations (IOPS, storage limits under replication factors), and cluster state transitions (e.g., peer offline vs. decommission). Understanding .conf file behavior under high-availability constraints is crucial. Our practice materials include cluster state and capacity calculation questions.

The Splunk Enterprise Certified Architect certification is valid for 3 years from issuance. You can recertify either by passing a higher-level exam (such as Splunk Core Certified Consultant) or by retaking the SPLK-2002 exam before expiration.

A 7-day wait for the second attempt, 14 days for the third, and longer cooling-off periods for subsequent attempts. Each retake requires the full $130 fee.

Scaled scoring is used across all forms. You receive an immediate pass/fail printout from Pearson VUE showing performance percentages per domain.

Our mock exam covers all 20 domains with the same weight distribution as the real test — from IOPS/capacity planning calculations and single-site/multisite indexer cluster topology with $SRF$/$SSF$ factors through SHC captaincy mechanics, Deployment Server configuration, btool configuration debugging, Job Inspector search bottleneck analysis, and KV Store replication across clustered nodes. Each question includes detailed architectural reasoning.

Yes. The downloadable PDF contains the same question bank as the online version, including answer explanations covering indexer cluster peer state transitions, SHC Deployer configuration and captaincy transfer, btool precedence debugging, limits.conf and indexes.conf performance tuning, Job Inspector execution cost analysis, and KV Store lookup synchronization. It is designed for offline study.

Candidates frequently report Multisite Indexer Cluster with $SRF$/$SSF$ calculations, Resource Planning with IOPS/storage math, and Indexer Cluster Management (peer offline vs. decommission) as the most demanding. The troubleshooting domains — especially Configuration Problems with file precedence and Search Problems with the Job Inspector — also require significant preparation. Our practice questions include focused drills on these high-difficulty areas.