SPLK-2002: Splunk Enterprise Certified ArchitectDemo

Question

Splunk Enterprise uses a cyclic redundancy check (CRC) of the first and last bytes to avoid re-indexing the same file when it is rotated or renamed. How many bytes are sampled by default?

A 512
B 256
C 128
D 64

Explanation

With the default endpoint_md5 checksum method, Splunk Enterprise calculates a checksum from the first and last 256 bytes of a file. A matching checksum identifies the file as already indexed after a rename or rotation.

Learn more

props.conf | Splunk Docs

SPLK-2002: Splunk Enterprise Certified ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ171

Community Discussion