Objective 9.1
Enterprise Certified ArchitectIdentify Splunk’s internal log files
Objective 9.1 sits in Clarifying the Problem, which carries 5% of the Enterprise Certified Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A team lead asks where Splunk internal logs are written. Which index receives them?
Correct.
Checked against help.splunk.com, August 2026Concept
Knowing which index holds the platform's own logs is what makes troubleshooting a search rather than a file hunt. It is monitored by default so the data is already there.
Why D
Splunk states that the internal logs are located in the var log splunk path, that this path is monitored by default, and that the contents are sent to the _internal index.
Source
Splunk Docs: What Splunk software logs about itself, checked August 2026The Splunk software internal logs are located in: $SPLUNK_HOME/var/log/splunk . This path is monitored by default, and the contents are sent to the _internal index.
Now you: objective 9.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team lead asks where search logs live. What does Splunk say?
Sample question 2 of 3
An engineer asks what a forwarder sends from its logs. What does Splunk say?
Sample question 3 of 3
An administrator asks what platform instrumentation populates. What does Splunk say?
Full Enterprise Certified Architect question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.