Splunk Enterprise Certified Architect Practice Test

Which logs are included in the _introspection index for Splunk Enterprise platform instrumentation?

1. audit.log

2. metrics.log

3. disk_objects.log

4. resource_usage.log

The correct answer is: disk_objects.log

The _introspection index in Splunk is specifically designed to store internal performance-related information about the Splunk instance, which includes various metrics and usage data. Among the logs that this index captures, disk_objects.log is particularly significant because it records the details about the disk usage of indexed data. This information is crucial for analyzing storage performance and efficiency, making it essential for administrators who need to monitor resource allocation and manage disk space effectively. On the other hand, audit.log tracks user activities and changes made to the system, metrics.log captures performance metrics from the Splunk engine, and resource_usage.log provides information about system resource usage. While all these logs are valuable for performance monitoring, only disk_objects.log specifically addresses the storage aspects in the context of the _introspection index, aligning with the purpose of capturing internal metrics for analysis.