SPLK-1003 · Question #38
Which valid bucket types are searchable? (select all that apply)
The correct answer is A. Hot buckets B. Cold buckets C. Warm buckets. Splunk uses a bucket lifecycle to manage indexed data: Hot (A), Warm (C), and Cold (B) buckets are all searchable. Hot buckets are actively being written to and are immediately searchable. Warm buckets are closed to new writes but remain on fast storage and are fully searchable.
Question
Which valid bucket types are searchable? (select all that apply)
Options
- AHot buckets
- BCold buckets
- CWarm buckets
- DFrozen buckets
How the community answered
(34 responses)- A88% (30)
- D12% (4)
Explanation
Splunk uses a bucket lifecycle to manage indexed data: Hot (A), Warm (C), and Cold (B) buckets are all searchable. Hot buckets are actively being written to and are immediately searchable. Warm buckets are closed to new writes but remain on fast storage and are fully searchable. Cold buckets have been moved to cheaper/slower storage but are still indexed and searchable. Frozen buckets (D) are NOT searchable - they have been archived and removed from the index, typically compressed or moved to long-term storage. To search frozen data, it must first be 'thawed' (restored to a thawed bucket), which then becomes searchable again.
Topics
Community Discussion
No community discussion yet for this question.