Objective 3.1

Enterprise Certified Architect

Understand design and size indexes

Objective 3.1 sits in Infrastructure Planning: Index Design, which carries 5% of the Enterprise Certified Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.

Objective title verbatim from the official objectives. Splunk exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

3-1Infrastructure Planning: Index Design

An administrator asks what an index contains. Which two file categories does Splunk name?

Buckets and stanzasBuckets are the directories those files live in.
Rawdata and index filesCorrect · your answerCorrect.
Sources and sourcetypesSource and source type are fields on the events.
Events and searchesSearches read the index rather than being stored in it.

Correct.

Checked against help.splunk.com, August 2026

Concept

One half is the compressed original and the other is what makes it findable. Sizing and integrity questions both come back to that split.

Why B

Splunk states that an index contains files falling into two main categories: the raw data in compressed form, and index files that point to the raw data, also called tsidx files, plus some metadata files.

Source

A Splunk Enterprise index contains a variety of files. These files fall into two main categories: The raw data in compressed form ( rawdata ) Indexes that point to the raw data ( index files , also referred to as tsidx files ), plus some metadata files

Splunk Docs: Indexes, indexers, and indexer clusters, checked August 2026
#indexes#design

Now you: objective 3.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

3-1Infrastructure Planning: Index Design

An analyst asks what buckets are. How does Splunk describe them?

Sample question 2 of 3

3-1Infrastructure Planning: Index Design

A team lead asks what happens to indexes as they age. What does Splunk say?

Sample question 3 of 3

3-1Infrastructure Planning: Index Design

An engineer asks how to start indexing new data. What does Splunk say?

Full Enterprise Certified Architect question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Infrastructure Planning: Index Design