SPLK-2002(205Q) · Question #150
When preparing to ingest a new data source, which of the following is optional in the data source assessment?
The correct answer is D. Data retention. Data retention is optional in the data source assessment because it is not directly related to the ingestion process. Data retention is determined by the index configuration and the storage capacity of the Splunk platform. Data format, data location, and data volume are all…
Question
When preparing to ingest a new data source, which of the following is optional in the data source assessment?
Options
- AData format
- BData location
- CData volume
- DData retention
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- D92% (24)
Explanation
Data retention is optional in the data source assessment because it is not directly related to the ingestion process. Data retention is determined by the index configuration and the storage capacity of the Splunk platform. Data format, data location, and data volume are all essential information for planning how to collect, parse, and index the data source. Drive more value through data source and use case optimization - Splunk, page 9 Data source planning for Splunk Enterprise Security
Topics
Community Discussion
No community discussion yet for this question.