Before users can use a KV store, an admin must create a collection. Where is a collection is defined?
Before users can use a KV store, an admin must create a collection. Where is a collection is defined?
A collection in a KV store is defined in the collections.conf file. This configuration file specifies the settings and parameters for KV Store collections in Splunk. Without this configuration, the collection cannot be created and used by the users.
Answer is C. See Clustering slides 217.
Answer C
https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/
collections.conf
Before you create a KV Store lookup, your Splunk deployment must have at least one KV Store collection. Certain apps, such as Enterprise Security, include KV Store collections with their installation. KV Store collections are databases. They store your data as key/value pairs. When you create a KV Store lookup, the collection should have at least two fields. One of those fields should have a set of values that match with the values of a field in your event data, so that lookup matching can take place.