nerdexam
Splunk

SPLK-1003 · Question #49

Which of the following are required when defining an index in indexes. conf? (select all that apply)

The correct answer is A. coldPath B. homePath D. thawedPath. When defining a custom index in indexes.conf, three path attributes are required: homePath (B) specifies where hot and warm buckets are stored (fastest storage), coldPath (A) specifies where cold buckets are stored after they age out of warm, and thawedPath (D) specifies where fr

Splunk Indexing

Question

Which of the following are required when defining an index in indexes. conf? (select all that apply)

Options

  • AcoldPath
  • BhomePath
  • CfrozenPath
  • DthawedPath

How the community answered

(32 responses)
  • A
    94% (30)
  • C
    6% (2)

Explanation

When defining a custom index in indexes.conf, three path attributes are required: homePath (B) specifies where hot and warm buckets are stored (fastest storage), coldPath (A) specifies where cold buckets are stored after they age out of warm, and thawedPath (D) specifies where frozen data can be restored to (thawed) for searching. All three paths must be defined for a valid index configuration. frozenPath (C) is not a valid indexes.conf attribute - frozen data archival is instead configured using coldToFrozenDir (to copy to a directory) or coldToFrozenScript (to run a custom archival script). Omitting any of the three required paths will prevent the index from being created properly.

Topics

#indexes.conf#Index paths#Index configuration#Required settings

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice