Splunk Enterprise Certified Architect — Question 66

Where can files be placed in a configuration bundle on a search peer that will persist after a new configuration bundle has been deployed?

Answer options

• A. Nowhere; the entire configuration bundle is overwritten with each push.
• B. In the SSPLUNK_HOME/etc/slave-apps/_cluster/local folder.
• C. In the SSPLUNK_HOME/etc/master-apps//local folder.
• D. In the SSPLUNK_HOME/etc/slave-apps//local folder.

Correct answer: A

Explanation

The correct answer is A because every time a new configuration bundle is pushed, the entire bundle is replaced, meaning no files can persist. The other options suggest specific locations within the Splunk directory structure where files could be saved, but they are incorrect as they do not allow for persistence after a configuration bundle deployment.