If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?
Agreed B. Quoting the Splunk Reference URL https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html
"Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf"
Correct Answer is B
1. Delete old data on indexers
2. Change inputs.conf on deployment server (or forwarders)
3. Reset the fishbucket checkpoint on the involved forwarders
4 Restart Splunk forwarders
Option A is incorrect because resetting the fishbucket on the indexer would not have any effect on the universal forwarder.
Option C is incorrect because resetting the fishbucket on the search head is not necessary in this scenario.
Option D is incorrect because the deployment server is used to manage and distribute configurations to forwarders, but resetting the fishbucket would need to be done on the forwarder itself.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
newrose
Highly Voted 2 years, 10 months agoucsdmiami2020
2 years agohwangho
Highly Voted 2 years, 9 months agoFrozenYeti
Most Recent 2 months, 2 weeks agokolaturka
6 months, 2 weeks agoFe01
1 year, 8 months agoIndicatorDeStafeta
1 year, 10 months agoPowdered_Sugar
1 year, 11 months agoSalman23
2 years agoLerd15
2 years, 9 months ago