A Splunk administrator is planning to migrate older data to a slower, cheaper storage tier to reduce costs. The data is currently in warm buckets. What must the administrator do to move this data to the slower storage tier while keeping it searchable?

Freeze the warm buckets to archive them

Change the bucket lifecycle policy to roll warm buckets to cold

Use a search head to access the data directly from the slower storage

Manually move the bucket files to the slower storage

A consultant is ingesting logs from a network device that sends data with a timestamp in UTC but the local timezone is required for analysis. The consultant wants to ensure that the events are indexed with the correct local time. Which configuration should be applied?

Set TZ in props.conf for the source type to the local timezone

Change the system timezone on the indexer

Set TIME_FORMAT in props.conf to include the timezone offset

Use transforms.conf to convert the timestamp to local time

In Splunk's event processing pipeline, which sequence correctly represents the order of stages from raw data input to indexed events?

Input → Indexing → Parsing → Searching

Searching → Input → Parsing → Indexing

Input → Parsing → Indexing → Searching

Parsing → Input → Indexing → Searching

A Splunk environment is experiencing high CPU usage on the indexers during peak ingestion. The consultant suspects that the parsing phase is inefficient. Which optimization is most likely to reduce CPU load during parsing?

Use transforms.conf to remove fields before indexing

Enable parallel parsing on the indexer

Increase the number of buckets per index to spread the load

Disable unnecessary source type detection by setting a fixed source type in inputs.conf

Which metadata is typically extracted during the parsing stage of Splunk's data pipeline?

Search results and event counts

SplunkCore Certified Consultant

Domain 5Objective 2

Describe Event Processing and Data Pipelines CORE-CERTIFIED-CONSULTANT Practice Questions (Page 4)

Part of the Indexing domain, which accounts for 14% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

14%of the exam

Questions 16–20

16application · medium
A Splunk administrator is planning to migrate older data to a slower, cheaper storage tier to reduce costs. The data is currently in warm buckets. What must the administrator do to move this data to the slower storage tier while keeping it searchable?
Select an answer first
17expert · hard
A consultant is ingesting logs from a network device that sends data with a timestamp in UTC but the local timezone is required for analysis. The consultant wants to ensure that the events are indexed with the correct local time. Which configuration should be applied?
Select an answer first
18foundation · easy
In Splunk's event processing pipeline, which sequence correctly represents the order of stages from raw data input to indexed events?
Select an answer first
19application · medium
A Splunk environment is experiencing high CPU usage on the indexers during peak ingestion. The consultant suspects that the parsing phase is inefficient. Which optimization is most likely to reduce CPU load during parsing?
Select an answer first
20foundation · easy
Which metadata is typically extracted during the parsing stage of Splunk's data pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.