Splunk Basics and Interface Navigation →hardMultiple ChoiceObjective-mapped

SPLK-1001 Splunk Basics and Interface Navigation Practice Question

Exhibit

Refer to the exhibit.

```
[default]
maxGlobalTimeFieldSec = 3600

[sample_index]
repFactor = auto
maxGlobalTimeFieldSec = 604800
```

Refer to the exhibit. An administrator notices that searches against the 'sample_index' index return events older than 24 hours, while searches against other indexes do not. What is the most likely explanation?

⚠ Common exam trap

Many exam-takers confuse `maxGlobalTimeFieldSec` with the `maxTimeFieldSec` setting (which limits the maximum time range a user can search), or assume that the issue is related to search time range configuration or replication factor, rather than the index-level time constraint for global searches.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The maxGlobalTimeFieldSec setting for 'sample_index' is much higher than the default.

The `maxGlobalTimeFieldSec` setting in indexes.conf controls the maximum age (in seconds) of events that can be returned by a global search (i.e., a search without an explicit time range). If this value is set much higher than the default (which is typically 86400 seconds, or 24 hours), searches against that index will return events older than 24 hours even when no time range is specified. This explains why only 'sample_index' shows older data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The maxGlobalTimeFieldSec setting for 'sample_index' is much higher than the default.
Why this is correct
maxGlobalTimeFieldSec limits the time window for searches; a higher value allows older events.
✗
The default stanza sets a maxGlobalTimeFieldSec that applies to all indexes, but is overridden incorrectly.
Why it's wrong here
The default stanza is overridden for sample_index, but the effect is as described.
✗
The index 'sample_index' has a replication factor set that allows older data.
Why it's wrong here
repFactor affects copy count, not time window.
✗
The search time range is configured in the search itself to include older data for that index.
Why it's wrong here
The exhibit is server config, not search time range.

Go deeper

SPLK-1001 Splunk Basics and Interface Navigation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question