Splunk Enterprise Certified Architect — Question 75

When troubleshooting a situation where some files within a directory are not being indexed, the ignored files are discovered to have long headers. What is the first thing that should be added to inputs.conf?

Answer options

• A. Add a crcSalt=attribute.
• B. Increase the value of initCrcLength.
• C. Decrease the value of initCrcLength.
• D. Add a crcSalt=attribute.

Correct answer: B

Explanation

The correct answer is B because increasing the initCrcLength allows for longer headers to be considered during the indexing process. Options A and D are incorrect as adding a crcSalt=attribute does not address the issue of long headers. Option C would further complicate the indexing by reducing the length considered, which is not helpful in this situation.