Splunk Core Certified User — Question 133

Which component of Splunk is primarily responsible for saving data?

Answer options

• A. Search Head
• B. Heavy Forwarder
• C. Indexer
• D. Universal Forwarder

Correct answer: C

Explanation

The correct answer is C, the Indexer, because it is the component specifically designed to store and manage indexed data in Splunk. The Search Head is responsible for searching and analyzing data, the Heavy Forwarder is used for data routing, and the Universal Forwarder is primarily for data collection and forwarding to the Indexer.