When ES content is exported, an app with a .spl extension is automatically created.
What is the best practice when exporting and importing updates to ES content?
When ES content is exported, an app with a .spl extension is automatically created.
What is the best practice when exporting and importing updates to ES content?
The best practice when exporting and importing updates to ES content is to either use new app names each time content is exported or to always include both existing and new content for each export. This ensures that you properly manage app versions and prevent the loss of any important ES content.
Correct Answer: D Either use new app names each time (which could be difficult to manage) or make sure you always include all content (old and new) each time you export. Ref: Administering Splunk Enterprise Security, Page 286.
Either use new app names each time (which could be difficult to manage) or make sure you always include all content (old and new) each time you export ref : admin ES 6.6 page 238
D is correct
D is correct
C is correct