Question 11

Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint information for that file?
  • Question 12

    Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?
  • Question 13

    When does a warm bucket roll over to a cold bucket?
  • Question 14

    You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command:
    splunk btoo1 props list -debug. What will the output be?
  • Question 15

    Consider the following stanza in inputs.conf:

    What will the value of the source filed be for events generated by this scripts input?