Discuss Splunk SPLK-2002 Exam Topic 6 Question 107

As of Splunk 9.0, which index records changes to . conf files?

A_configtracker

B_introspection

C_internal

D_audit

Suggested Answer: A

This is the index that records changes to .conf files as of Splunk 9.0.According to the Splunk documentation1, the _configtracker index tracks the changes made to the configuration files on the Splunk platform, such as the files in the etc directory.The _configtracker index can help monitor and troubleshoot the configuration changes, and identify the source and time of the changes1. The other options are not indexes that record changes to .conf files.Option B, _introspection, is an index that records the performance metrics of the Splunk platform, such as CPU, memory, disk, and network usage2.Option C, _internal, is an index that records the internal logs and events of the Splunk platform, such as splunkd, metrics, and audit logs3.Option D, _audit, is an index that records the audit events of the Splunk platform, such as user authentication, authorization, and activity4. Therefore, option A is the correct answer, and options B, C, and D are incorrect.

1: About the _configtracker index2: About the _introspection index3: About the _internal index4: About the _audit index

Get Premium SPLK-2002 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Regenia 10 months ago

_internal doesn't track .conf changes, just FYI.

Dorcas 11 months ago

Wait, are you sure it's not _introspection?

Merilyn 11 months ago

Yup, _configtracker is the one!

Billye 11 months ago

I thought it was _audit?

Cyril 11 months ago

It's definitely _configtracker!

Dominga 12 months ago

I'm leaning towards _configtracker too, but I also remember some questions about _internal that confused me.

Francoise 12 months ago

I vaguely recall that _audit tracks changes, but I don't remember if it specifically covers .conf files.

Rikki 12 months ago

I feel like _introspection is related to internal metrics, not config changes. But I could be wrong.

Ahmad 1 year ago

I think the answer might be _configtracker, but I'm not completely sure. I remember it being mentioned in a practice question.

Ronny 1 year ago

Aha, I remember learning about the _introspection index in my Splunk training. That's where Splunk stores information about its own internal operations, including configuration changes.

Edwin 1 year ago

The _audit index is where Splunk logs security-related events, so that's not the right answer. Let me review the other options more closely.

Candra 1 year ago

I'm a bit confused on this one. I know Splunk has different internal indexes, but I'm not sure which one specifically tracks .conf file changes.

Lenny 1 year ago

Okay, I think I know the answer to this one. The _configtracker index is where Splunk records changes to .conf files, right?

Carin 1 year ago

Hmm, this seems like a tricky one. I'll need to think carefully about the different index options and what they're used for in Splunk.

Ona 2 years ago

Ha, I bet it's _introspection. Everything in Splunk is 'introspective' these days, aren't they?

Melda 2 years ago

Hmm, I'm leaning towards _internal. Isn't that where Splunk logs all sorts of internal events and changes?

Jenifer 2 years ago

↳ replying to Melda

Yeah, I agree. Let's go with _internal.

France 2 years ago

↳ replying to Melda

I think you're right, _internal does seem like the most logical choice.

Shannon 2 years ago

↳ replying to Melda

D) _audit

Francoise 2 years ago

↳ replying to Melda

C) _internal

Chauncey 2 years ago

↳ replying to Melda

B) _introspection

Desmond 2 years ago

↳ replying to Melda

A) _configtracker

Sylvie 2 years ago

I'm not sure, but I think it might be C) _internal. Can someone explain why it's not the correct answer?

Carry 2 years ago

I agree with Pearlie, because the _audit index records changes to configuration files.

Cordelia 2 years ago

Wait, isn't _configtracker the index for that? I'm pretty sure that's the one they introduced in 9.0.

Nu 2 years ago

↳ replying to Cordelia

I think you're right, _configtracker is the index for that in Splunk 9.0.

Natalie 2 years ago

↳ replying to Cordelia

Yes, you're correct! _configtracker is the index that records changes to .conf files in Splunk 9.0.

Lashandra 2 years ago

I think it's _audit, that's where Splunk typically logs configuration changes, right?

Stephanie 2 years ago

↳ replying to Lashandra

Oh, I see. Thanks for clarifying that!

Albina 2 years ago

↳ replying to Lashandra

Actually, it's _configtracker that records changes to .conf files in Splunk 9.0.

Telma 2 years ago

↳ replying to Lashandra

I believe it's _internal, that's where Splunk stores internal logs and metrics.

Arlene 2 years ago

↳ replying to Lashandra

Yes, you're correct. _audit index records changes to .conf files.

Pearlie 2 years ago

I think the answer is D) _audit.

Splunk SPLK-2002 Exam - Topic 6 Question 107 Discussion