MENU
If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component
would the fishbucket need to be reset in order to reindex the data?
Suggested Answer: A
Get Premium SPLK-1003 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
DE
Denna
11 months ago
Nope, it's definitely the Indexer.
KE
Keva
11 months ago
I didn't know that! Mind blown!
AM
Amie
12 months ago
Wait, are you sure? I thought it was the Forwarder.
AP
Apolonia
12 months ago
Totally agree, it's all about the Indexer!
EZ
Ezekiel
12 months ago
You need to reset the fishbucket on the Indexer.
CA
Carlene
1 year ago
I’m confused because I thought the fishbucket was tied to the Indexer, but now I’m questioning if it’s actually the Forwarder.
TA
Tamar
1 year ago
I remember something about the Forwarder, but I can't recall if that's where the fishbucket is reset. It feels like a tricky question.
GL
Glory
1 year ago
I think the fishbucket needs to be reset on the Indexer, but I'm not entirely sure. It might be related to how data is processed.
CA
Cassi
1 year ago
I practiced a similar question last week, and I think it was about resetting the fishbucket on the Forwarder. That seems to make sense here too.
YO
Yoko
1 year ago
I'm pretty confident this will output NULL. The if statement checks if $a is truthy, and null is falsy, so the echo statement won't execute.
MA
Marsha
1 year ago
Hmm, I'm a bit unsure about this one. The question mentions the user's security profile, so I'm wondering if the answer has something to do with that. I'll have to think it through carefully.