Splunk Core Certified Advanced Power User — Question 143

A Splunk administrator has been tasked with developing a retention strategy to have frequently accessed data sets on SSD storage and to have older, less frequently accessed data on slower NAS storage. They have set a mount point for the NAS. Which parameter do they need to modify to set the path for the older, less frequently accessed data in indexes.conf?

Answer options

• A. thawedPath
• B. coldPath
• C. homePath
• D. summaryHomePath

Correct answer: B

Explanation

The correct answer is B, coldPath, as it specifies where older, less frequently accessed data should be stored. A, thawedPath, is related to data that has been restored from cold storage, C, homePath, is for the active data storage, and D, summaryHomePath, pertains to storing summary index data, making them unsuitable for this scenario.