Splunk Core Certified Advanced Power User — Question 112

Which of the following are reasons to create separate indexes? (Choose all that apply.)

Answer options

• A. Different retention times.
• B. Increase number of users.
• C. Restrict user permissions.
• D. File organization.

Correct answer: A, C

Explanation

Creating separate indexes can be beneficial for managing data with different retention times, as it allows for tailored data lifecycle management. Additionally, restricting user permissions is another valid reason, ensuring that only authorized individuals can access certain data. The other options, while relevant to system usage, do not directly justify the need for separate indexes.