Splunk Core Certified Advanced Power User — Question 17

Which setting in indexes.conf allows data retention to be controlled by time?

Answer options

• A. maxDaysToKeep
• B. moveToFrozenAfter
• C. maxDataRetentionTime
• D. frozenTimePeriodInSecs

Correct answer: D

Explanation

The correct answer is D, as frozenTimePeriodInSecs directly specifies the duration for which data is retained before being moved to a frozen state. Options A, B, and C do not specifically control data retention by time in the same way; for instance, maxDaysToKeep relates to days rather than a specific time period.