Which of the following are reasons to create separate indexes? (Choose all that apply.)

The correct answer is A. Different retention times. C. Restrict user permissions. Different retention times (A): Each index can have its own retention policy (maxTotalDataSizeMB, frozenTimePeriodInSecs), making it essential to separate data with different lifecycle requirements into different indexes. Restrict user permissions (C): Splunk's role-based access…

Splunk Indexing

Question

Options

ADifferent retention times.
BIncrease number of users.
CRestrict user permissions.
DFile organization.

How the community answered

(31 responses)

A
90% (28)
B
6% (2)
D
3% (1)

Explanation

Different retention times (A): Each index can have its own retention policy (maxTotalDataSizeMB, frozenTimePeriodInSecs), making it essential to separate data with different lifecycle requirements into different indexes. Restrict user permissions (C): Splunk's role-based access control (RBAC) grants or restricts search access at the index level, so separate indexes allow fine-grained data access control per user or role. Increasing the number of users (B) is unrelated to index architecture. File organization (D), while sometimes a side effect, is not a primary operational reason Splunk documentation cites for creating separate indexes.

Topics

#Splunk Indexes#Index Management#Data Retention#User Permissions

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice