If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

The correct answer is A. Indexer. Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf.

Splunk Indexing

Question

Options

AIndexer
BForwarder
CSearch head
DDeployment server

How the community answered

(36 responses)

A
86% (31)
B
6% (2)
C
3% (1)
D
6% (2)

Explanation

Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf.

Topics

#fishbucket#indexing process#universal forwarder#inputs.conf

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice