Splunk Core Certified Consultant — Question 28

When is data deleted from a Splunk Cloud index?

Answer options

• A. When buckets roll to frozen, without a defined archive.
• B. When data is deleted via the Splunk Cloud Admin GUI.
• C. When TA_Delete is downloaded and enabled from SplunkBase.
• D. When the deleteindex command is executed from the CLI.

Correct answer: A

Explanation

Data in a Splunk Cloud index is deleted when buckets roll to the frozen state and there is no archive defined to retain the data. The other options describe actions that do not result in the automatic deletion of data from the index, such as using the GUI or specific commands that require additional configurations.