ExamGecko
Question list
Search
Search

Question 20 - SPLK-1003 discussion

Report
Export

If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

A.
Indexer
Answers
A.
Indexer
B.
Forwarder
Answers
B.
Forwarder
C.
Search head
Answers
C.
Search head
D.
Deployment server
Answers
D.
Deployment server
Suggested answer: A

Explanation:

https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html

"Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf" Reference https://community.splunk.com/t5/Archive/How-to-reindex-data-from-a-forwarder/tdp/93310

asked 23/09/2024
Okan YILDIZ
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first