Splunk Enterprise Certified Architect — Question 72

Splunk Enterprise performs a cyclic redundancy check (CRC) against the first and last bytes to prevent the same file from being re-indexed if it is rotated or renamed. What is the number of bytes sampled by default?

Answer options

• A. 512
• B. 256
• C. 128
• D. 64

Correct answer: B

Explanation

The correct answer is B, as Splunk Enterprise samples 256 bytes by default for CRC to ensure file integrity and avoid duplicate indexing. The other options do not reflect the correct default byte size used for this purpose in Splunk.