Splunk Enterprise Security Certified Analyst — Question 63

In which directory should base config app(s) be placed to initialize an indexer?

Answer options

• A. $SPLUNK_HOME/etc/<app_name>
• B. $SPLUNK_HOME/etc/apps
• C. $SPLUNK_HOME/etc/system/local
• D. $SPLUNK_HOME/etc/slave-apps

Correct answer: B

Explanation

The correct answer is B, as base config apps should be placed in the $SPLUNK_HOME/etc/apps directory for proper initialization of an indexer. Option A is incorrect because it refers to a specific app's directory, which is not meant for base configurations. Option C is wrong as it is for system-level configurations, while D is not typically used for base configurations either.