splk-1003 question 125 discussion

View all Splunk Enterprise Certified Admin Exam here
back to splunk forum

Question 125

All search-time field extractions should be specified on which Splunk component?

  • A. Deployment server
  • B. Universal forwarder
  • C. Indexer
  • D. Search head
Answer:

C


Explanation:
Reference:
https://github.com/packetiq/SplunkArchitect/blob/master/README/props.conf.spec

User Votes:
A
50%
B
50%
C
50%
D 1 votes
50%
Discussions
0 / 1000
francesco.brizzi
3 weeks, 3 days ago

in search-time D. Search head

0