In the diagrammed environment shown below, the customer would like the data read by the universal forwarders to set an indexed field containing the UF's host name. Where would the parsing configurations need to be installed for this to work?

• A.All universal forwarders.
• B.Only the indexers.
• C.All heavy forwarders.
• D.On all parsing Splunk instances.

Comment: *

Name: *

Email: *

Verification: *

When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?

• A.All replicated copies will be rolled to frozen; original copies will remain.
• B.Replicated copies of the bucket will remain on all other indexers and the Cluster Master (CM) assigns a new primary bucket.
• C.The bucket rolls to frozen on all clustered indexers simultaneously.
• D.Nothing. Replicated copies of the bucket will remain on all other indexers until a local retention rule causes it to roll.

Comment: *

Name: *

Email: *

Verification: *