Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Splunk Exam SPLK-2002 Topic 6 Question 107 Discussion

Actual exam question for Splunk's SPLK-2002 exam
Question #: 107
Topic #: 6
[All SPLK-2002 Questions]

As of Splunk 9.0, which index records changes to . conf files?

Show Suggested Answer Hide Answer
Suggested Answer: A

This is the index that records changes to .conf files as of Splunk 9.0.According to the Splunk documentation1, the _configtracker index tracks the changes made to the configuration files on the Splunk platform, such as the files in the etc directory.The _configtracker index can help monitor and troubleshoot the configuration changes, and identify the source and time of the changes1. The other options are not indexes that record changes to .conf files.Option B, _introspection, is an index that records the performance metrics of the Splunk platform, such as CPU, memory, disk, and network usage2.Option C, _internal, is an index that records the internal logs and events of the Splunk platform, such as splunkd, metrics, and audit logs3.Option D, _audit, is an index that records the audit events of the Splunk platform, such as user authentication, authorization, and activity4. Therefore, option A is the correct answer, and options B, C, and D are incorrect.

1: About the _configtracker index2: About the _introspection index3: About the _internal index4: About the _audit index


by Heidy at Feb 05, 2025, 11:10 PM

Limited Time Offer

25%

Off

Get Premium SPLK-2002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Carry
2 days ago
I agree with Pearlie, because the _audit index records changes to configuration files.
upvoted 0 times
...
Cordelia
4 days ago
Wait, isn't _configtracker the index for that? I'm pretty sure that's the one they introduced in 9.0.
upvoted 0 times
...
Lashandra
14 days ago
I think it's _audit, that's where Splunk typically logs configuration changes, right?
upvoted 0 times
...
Pearlie
16 days ago
I think the answer is D) _audit.
upvoted 0 times
...

Save Cancel