Splunk Core Certified Advanced Power User — Question 51

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Answer options

• A. Buy a bigger Splunk license.
• B. Add 2.5 TB each day for the next 5 days.
• C. Add all 10 TB in a single 24 hour period.
• D. Add 200 GB of historical data each day for 50 days.

Correct answer: C

Explanation

The correct answer is C because adding all 10 TB in one day will ensure it is accounted for under the daily limit, avoiding additional license issues. Options A and B would still lead to license violations, while D would extend the addition of historical data over too long a period, also causing problems with the license limit.