As a best practice, where should the internal licensing logs be stored?
As a best practice, where should the internal licensing logs be stored?
The internal licensing logs should be stored in the indexing layer. This is because the indexing layer is designed to store and manage various types of logs, including internal logs, making them easily searchable and maintainable. Storing logs in the indexing layer ensures that they are properly indexed and can be analyzed as needed.
Answer is A, All the internal logs, should be stored in indexing layer.
this is correct as they are stored in the _internal index
A is correct
A is correct pg 13 Cluster Admin
All data should be forwarded to the indexing layer in a multi-instance configuration
A is the answer
The reference doc, https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan, is AWOL.
A is correct