SPLK-2002(205Q) · Question #33
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all…
C (disk_objects.log) and D (resource_usage.log) are logged to the _introspection index because this index is specifically designed to capture Splunk's platform instrumentation - quantitative performance and resource data about the deployment itself, such as disk usage by…
Question
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)
Options
- Aaudit.log
- Bmetrics.log
- Cdisk_objects.log
- Dresource_usage.log
Explanation
C (disk_objects.log) and D (resource_usage.log) are logged to the _introspection index because this index is specifically designed to capture Splunk's platform instrumentation - quantitative performance and resource data about the deployment itself, such as disk usage by component and CPU/memory consumption per process. These logs are structured for monitoring the health and capacity of the Splunk infrastructure.
A (audit.log) is wrong - it belongs to the _audit index, which captures security and access auditing events like logins, searches, and configuration changes.
B (metrics.log) is wrong - it lives in the _internal index alongside other Splunk daemon logs like splunkd.log; _internal holds operational/diagnostic logs, not the structured performance telemetry that _introspection targets.
Memory tip: Think "_introspection = introspect the machine" - it answers "How is Splunk using my hardware?" (disk objects, resource usage). _audit = "Who did what?" and _internal = "What is splunkd saying?"
Topics
Community Discussion
No community discussion yet for this question.