SPLUNK 2 Power User Exam questions with correct answers

As events come in, Splunk places them into an index's ___________. CORRECT ANSWER hot bucket What are the only writable buckets? CORRECT ANSWER hot bucket's As buckets age, they roll from the hot to warm to cold. True or False? CORRECT ANSWER True Each bucket has its own raw data, metadata, and index files True or False? CORRECT ANSWER True What tracks the source, source type and host information in the index? CORRECT ANSWER Metadata files When you search, Splunk uses the time range to choose which buckets to search and then uses the bucket indexes to find qualifying events. True or False? CORRECT ANSWER True Why is time the most efficient filter when searching? CORRECT ANSWER Because events are stored in buckets by time What are the most powerful keywords after using time as a filter? CORRECT ANSWER Host Source