Splunk
SPLK-3003 · Question #25
The data in Splunk is now subject to auditing and compliance controls. A customer would like to ensure that at least one year of logs are retained for both Windows and Firewall events. What data…
The correct answer is A. maxTotalDataSizeMB and frozenTimePeriodInSecs. https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Setaretirementandarchivingpolicy
Security and Compliance Considerations
Question
The data in Splunk is now subject to auditing and compliance controls. A customer would like to ensure that at least one year of logs are retained for both Windows and Firewall events. What data retention controls must be configured?
Options
- AmaxTotalDataSizeMB and frozenTimePeriodInSecs
- BcoldToFrozenDir and coldToFrozenScript
- CSplunk Volume and maxTotalDataSizMB
- DSplunk Volume and frozenTimePeriodInSecs
How the community answered
(46 responses)- A74% (34)
- B15% (7)
- C4% (2)
- D7% (3)
Explanation
https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Setaretirementandarchivingpolicy
Topics
#data retention#maxTotalDataSizeMB#frozenTimePeriodInSecs#compliance
Community Discussion
No community discussion yet for this question.