Splunk Infrastructure Overview — Question 36

Which statement about tsidx files is accurate?

Answer options

• A. Splunk updates tsidx files every 30 minutes.
• B. Splunk removes outdated tsidx files every 5 minutes.
• C. A tsidx file consists of a lexicon and a posting list.
• D. Each bucket in each index may contain only one tsidx file.

Correct answer: C

Explanation

Option C is correct because a tsidx file indeed comprises a lexicon and a posting list, which are essential for indexing. Options A and B are incorrect as they misrepresent the update and deletion frequency of tsidx files, while option D is wrong because each bucket can contain multiple tsidx files, not just one.