Open a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing tier.

Open a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.

Use a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit the data to the indexing tier.

Use a syslog server to aggregate the data to files and use a universal forwarder to read and transmit the data to the indexing tier.

/var/log/secure

/var/log/messages

/var/log/messages, /var/log/cron, /var/log/audit, /var/log/secure

/var/log/secure, /var/log/messages

Topology Category Code: M4

Topology Category Code: M14

Topology Category Code: C13

Topology Category Code: C3

$SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8

$SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/*.tsidx

$SPLUNK_HOME/var/lib/splunk/fishbucket

$SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/rawdata

find / -name server.conf –print | grep pass4SymKey

$SPLUNK_HOME/bin/splunk search | rest splunk_server=local /servicesNS/-/ unhash_app/storage/passwords

$SPLUNK_HOME/bin/splunk btool server list clustering | grep pass4SymmKey

$SPLUNK_HOME/bin/splunk btool clustering list clustering --debug | grep

pass4SymmKey

Option A

Option B

Option C

Option D

All indexers with a copy of the bucket will delete it.

The cluster master will ensure another copy of the bucket is made on the other peers to meet the replication settings.

The cluster master will no longer perform fix-up activities for the bucket.

All indexers with a copy of the bucket will immediately roll it to frozen.