Splunk Core Certified Advanced Power User — Question 73

If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

Answer options

• A. Indexer
• B. Forwarder
• C. Search head
• D. Deployment server

Correct answer: B

Explanation

The correct answer is B because the universal forwarder is responsible for collecting and forwarding data, and changes to inputs.conf affect how data is handled at that level. The other components, such as the Indexer, Search head, and Deployment server, do not directly manage the fishbucket for the forwarder and hence do not require a reset for this purpose.