Splunk Core Certified Advanced Power User — Question 154

What is the correct order of index time precedence?
(For each of the following, highest precedence is shown at the top and lowest precedence is shown at the bottom)

Answer options

• A. .../etc/users/local .../etc/system/default .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/local
• B. .../etc/users/local .../etc/system/local .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/default
• C. .../etc/system/local .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/default
• D. .../etc/system/default .../etc/apps/aaa/local .../etc/apps/zzz/default .../etc/system/local

Correct answer: C

Explanation

The correct answer is C because it reflects the highest to lowest precedence in the index time configuration. Options A, B, and D do not follow the correct order, placing lower precedence entries higher in the sequence.