Splunk Core Certified Advanced Power User — Question 117

What is the command to reset the fishbucket for one source?

Answer options

• A. rm -r ~/splunkforwarder/var/lib/splunk/fishbucket
• B. splunk clean eventdata -index _thefishbucket
• C. splunk cmd btprobe -d SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file--reset
• D. splunk btool fishbucket reset

Correct answer: C

Explanation

The correct answer is C, as it specifically uses the 'splunk cmd btprobe' command with the appropriate options to reset the fishbucket for a source. Option A removes the entire fishbucket directory, which does not specifically reset it for one source. Option B deals with cleaning event data for the fishbucket index rather than resetting it. Option D uses 'btool', which is not the correct method for resetting the fishbucket.