Splunk Core Certified Advanced Power User — Question 56
Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint information for that file?
Answer options
- A. _audit
- B. _checkpoint
- C. _introspection
- D. _thefishbucket
Correct answer: D
Explanation
The correct answer is D, _thefishbucket, as it stores information about the files that have been monitored and their input checkpoints. Cleaning this index is necessary to ensure that the input checkpoint data aligns with the reindexed data. The other options do not hold the checkpoint information related to the monitored files.