A Splunk administrator is managing a multi-tenant Splunk environment where different departments have different retention requirements. The HR department needs to retain employee data for 7 years, while the marketing department only needs 6 months of data. The administrator wants to ensure that each department's data is retained according to its policy. What is the best approach?

Create a separate index for each department and configure the retention settings accordingly.

Use a single index and rely on search-time filters to control retention.

Use a single index and set the retention to the longest requirement (7 years) for all data.

Use a single index and set the retention to the shortest requirement (6 months) for all data.

A Splunk administrator is setting up a new index for audit logs. The compliance team requires that audit logs be archived to a network-attached storage (NAS) device when they reach the frozen state, and the archive must be in a format that can be re-imported into Splunk if needed. The administrator has written a script that copies the frozen buckets to the NAS. What additional configuration is needed to ensure the archive can be re-imported?

The script must be configured to run on the search head, not the indexer.

The script must convert the buckets to CSV format before copying.

The script must also copy the bucket metadata files, such as the .meta and .tsidx files.

The script must compress the buckets before copying to save space.

How can you apply different retention settings to individual indexes in Splunk?

By configuring separate stanzas in indexes.conf for each index

By creating a separate Splunk instance for each index

By using the same settings for all indexes by default

By setting a global retention policy in server.conf

SplunkCore Certified Consultant

Domain 5Objective 4

List Data Retention Controls CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Part of the Indexing domain, which accounts for 14% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

6concepts

14%of the exam

Questions 1–5

1foundation · easy
In which configuration file would you set the maximum size and maximum age of an index?
Select an answer first
2application · medium
A Splunk administrator is managing a multi-tenant Splunk environment where different departments have different retention requirements. The HR department needs to retain employee data for 7 years, while the marketing department only needs 6 months of data. The administrator wants to ensure that each department's data is retained according to its policy. What is the best approach?
Select an answer first
3foundation · easy
Which Splunk command can be used to view the size and age of indexes?
Select an answer first
4application · medium
A Splunk administrator is setting up a new index for audit logs. The compliance team requires that audit logs be archived to a network-attached storage (NAS) device when they reach the frozen state, and the archive must be in a format that can be re-imported into Splunk if needed. The administrator has written a script that copies the frozen buckets to the NAS. What additional configuration is needed to ensure the archive can be re-imported?
Select an answer first
5foundation · easy
How can you apply different retention settings to individual indexes in Splunk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

List Data Retention Controls CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Questions 1–5

In which configuration file would you set the maximum size and maximum age of an index?

Which Splunk command can be used to view the size and age of indexes?

How can you apply different retention settings to individual indexes in Splunk?

Keep studying — Indexing