Splunk Enterprise Security Certified Admin — Question 5
When ES content is exported, an app with a .spl extension is automatically created.
What is the best practice when exporting and importing updates to ES content?
Answer options
- A. Use new app names each time content is exported.
- B. Do not use the .spl extension when naming an export.
- C. Always include existing and new content for each export.
- D. Either use new app names or always include both existing and new content.
Correct answer: A
Explanation
The correct answer is A because using new app names each time helps to prevent overwriting existing applications and maintains a clear update history. Options B and C are incorrect as they do not align with best practices for managing content exports, and option D is not ideal since it allows for potential confusion in app management.