Which of the following applies only to Splunk index data integrity check?

The correct answer is C. Raw data in the index. The Splunk index data integrity check (run via splunk check-integrity) is specifically designed to verify the integrity of raw data stored in the index - the rawdata journal files. It generates and validates hash values for the raw compressed data slices to detect corruption or t

Splunk Indexing

Question

Options

ALookup table
BSummary Index
CRaw data in the index
DData model acceleration

How the community answered

(38 responses)

A
3% (1)
B
5% (2)
C
89% (34)
D
3% (1)

Explanation

The Splunk index data integrity check (run via splunk check-integrity) is specifically designed to verify the integrity of raw data stored in the index - the rawdata journal files. It generates and validates hash values for the raw compressed data slices to detect corruption or tampering. This check applies only to raw indexed data, not to lookup tables (A), which are flat files stored separately; not to summary indexes (B), which are generated search results written back as events; and not to data model accelerations (D), which are TSIDX files. Those other constructs are not covered by the index integrity check.

Topics

#Data Integrity#Splunk Indexing#Raw Data

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice