SPLK-2002(205Q) · Question #177
SPLK-2002(205Q) Question #177: Real Exam Question with Answer & Explanation
The correct answer is C. 10 GB. According to the indexes.conf reference in Splunk Enterprise, the parameter maxDataSize controls the maximum size (in GB or MB) of a single hot bucket before Splunk rolls it to a warm bucket. When the value is set to auto_high_volume on a 64-bit system, Splunk automatically sets
Question
Options
- A4 GB
- B750 MB
- C10 GB
- D1 GB
Explanation
According to the indexes.conf reference in Splunk Enterprise, the parameter maxDataSize controls the maximum size (in GB or MB) of a single hot bucket before Splunk rolls it to a warm bucket. When the value is set to auto_high_volume on a 64-bit system, Splunk automatically sets the maximum hot bucket size to 10 GB. The "auto" settings allow Splunk to choose optimized values based on the system architecture: auto: Default hot bucket size of 750 MB (32-bit) or 10 GB (64-bit). auto_high_volume: Specifically tuned for high-ingest indexes; on 64-bit systems, this equals 10 GB auto_low_volume: Uses smaller bucket sizes for lightweight indexes. The purpose of larger hot bucket sizes on 64-bit systems is to improve indexing performance and reduce the overhead of frequent bucket rolling during heavy data ingestion. The documentation explicitly warns that these sizes differ on 32-bit systems due to memory addressing limitations. Thus, for high-throughput environments running 64-bit operating systems, auto_high_volume = 10 GB is the correct and Splunk-documented configuration. - indexes.conf - maxDataSize Attribute Reference - Managing Index Buckets and Data Retention - Splunk Enterprise Admin Manual - Indexer Storage Configuration - Splunk Performance Tuning: Bucket Management and Hot/Warm Transitions
Community Discussion
No community discussion yet for this question.