Splunk Exam SPLK-1005 Topic 4 Question 7 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 7
Topic #: 4

[All SPLK-1005 Questions]

When creating a new index, which of the following is true about archiving expired events?

AStore expired events in private AWS-based storage.

BExpired events cannot be archived.

CArchive some expired events from an index and discard others.

DStore expired events on-prem using your own storage systems.

Show Suggested Answer

Suggested Answer: D

In Splunk Cloud, expired events can be archived to customer-managed storage solutions, such as on-premises storage. This allows organizations to retain data beyond the standard retention period if needed. [Reference: Splunk Docs on data archiving in Splunk Cloud]

by Elsa at Nov 19, 2024, 03:24 PM

Limited Time Offer

25%

26 days ago

I think option C is the correct answer. We should have the flexibility to archive some expired events and discard others as needed.

upvoted 0 times

...