If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?
Agreed B. Quoting the Splunk Reference URL https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html
"Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf"
Correct Answer is B
1. Delete old data on indexers
2. Change inputs.conf on deployment server (or forwarders)
3. Reset the fishbucket checkpoint on the involved forwarders
4 Restart Splunk forwarders
Option A is incorrect because resetting the fishbucket on the indexer would not have any effect on the universal forwarder.
Option C is incorrect because resetting the fishbucket on the search head is not necessary in this scenario.
Option D is incorrect because the deployment server is used to manage and distribute configurations to forwarders, but resetting the fishbucket would need to be done on the forwarder itself.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
newrose
Highly Voted 2 years, 8 months agoucsdmiami2020
1 year, 10 months agohwangho
Highly Voted 2 years, 7 months agoFrozenYeti
Most Recent 3 weeks, 6 days agokolaturka
4 months, 3 weeks agoFe01
1 year, 7 months agoIndicatorDeStafeta
1 year, 9 months agoPowdered_Sugar
1 year, 9 months agoSalman23
1 year, 11 months agoLerd15
2 years, 7 months ago