Splunk Enterprise Certified Admin Practice Test

To start indexing new data only, what should be done in the settings?

1. Set max file size

2. Enable followTail

3. Change directory permissions

4. Use ignoreOlderThan

The correct answer is: Enable followTail

To start indexing new data only, enabling the followTail setting is the most appropriate action. This configuration allows Splunk to begin indexing from the end of a file, thereby capturing only the newly added data rather than reindexing existing content. By doing so, it effectively reduces the load on the indexing process and avoids processing historical data that has already been ingested. The other options do have their specific purposes, but they do not directly address the need to index new data exclusively. For example, setting a max file size defines limitations on how large a file can be before it is no longer indexed but doesn't prevent the indexing of old data. Changing directory permissions may impact the ability of Splunk to read the data but does not control the indexing behavior itself. Using ignoreOlderThan would prevent files older than a specified time from being indexed, but it doesn't directly facilitate the focus on only new data if older data is still present and potentially eligible for indexing.