What is the effect of setting `maxTotalDataSizeMB = 1000` on an index?

The index will be limited to 1000 buckets

The index will only accept events that are 1000 MB or smaller

The index will delete all data older than 1000 days

The index will hold a maximum of 1000 MB of data before rolling oldest buckets to frozen

Which of the following is a way to monitor storage usage in Splunk?

Using the inputs page in Settings

Using the search head's job inspector

When a bucket transitions from cold to frozen, what does Splunk do by default if no `coldToFrozenScript` is configured?

Archives the bucket to a default location

Keeps the bucket in cold state indefinitely

Moves the bucket to a warm state

What happens to frozen data that is not archived via a script?

It is available for search with reduced performance

It is stored in a compressed format on disk

It is moved to a separate frozen index

SplunkCore Certified Consultant

Domain 5Objective 4

List Data Retention Controls CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Part of the Indexing domain, which accounts for 14% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

6concepts

14%of the exam

Questions 6–10

6foundation · easy
Which of the following settings directly controls how long data is retained in a Splunk index?
Select an answer first
7foundation · easy
What is the effect of setting `maxTotalDataSizeMB = 1000` on an index?
Select an answer first
8foundation · easy
Which of the following is a way to monitor storage usage in Splunk?
Select an answer first
9foundation · easy
When a bucket transitions from cold to frozen, what does Splunk do by default if no `coldToFrozenScript` is configured?
Select an answer first
10foundation · easy
What happens to frozen data that is not archived via a script?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.