Objective 12.2
Enterprise Certified ArchitectJob inspector
Objective 12.2 sits in Search Problems, which carries 5% of the Enterprise Certified Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An engineer asks when a job can be inspected. What does Splunk say?
Correct.
Checked against help.splunk.com, August 2026Concept
The inspector reads the artifact a search leaves behind, so availability follows the artifact's lifetime. Extending a job's lifetime is worth doing before investigating.
Why B
Splunk states that you can access the Search Job Inspector as long as the search job has not expired, meaning the search artifact still exists, and that the search does not need to be running.
Source
Splunk Docs: View search job properties, checked August 2026You can access the Search Job Inspector for a search job, as long as the search job has not expired (which means that the search artifact still exists). The search does not need to be running to access the Search Job Inspector.
Now you: objective 12.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A search returns fewer results than expected and you suspect an event type or a lookup. Besides search performance, what does the Search Job Inspector explain?
Sample question 2 of 3
After a costly search you open the Job Details dashboard rather than the itemized report. What does that dashboard display?
Sample question 3 of 3
You know the name of a saved search and need the logs for one particular run of it in the dispatch directory. What does audit.log give you to find them?
Full Enterprise Certified Architect question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.