The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours: index=* What field can the administrator check to see the data distribution?
A) host
B) index
C) linecount
D) splunk_server

Question

Quizplus · Accepted Answer

The "splunk_server" field indicates which indexer processed each event, allowing the administrator to see how data is distributed across the indexers.

The Splunk Administrator Wants to Ensure Data Is Distributed Evenly