Objective 9.2
Enterprise Certified ArchitectIdentify Splunk’s internal indexes
Objective 9.2 sits in Clarifying the Problem, which carries 5% of the Enterprise Certified Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Logs under the introspection path are monitored by default on your indexers and record the impact of Splunk on each host. Which index receives their contents?
Correct.
Checked against help.splunk.com, August 2026Concept
Resource usage data is kept apart from operational logging because it is generated differently and read for different questions. Separate indexes keep those questions separate.
Why D
Splunk states that the Splunk Introspection logs record data about the impact of the software on the host system, that the path is monitored by default, and that the contents are sent to the _introspection index.
Source
Splunk Docs: What Splunk software logs about itself, checked August 2026The Splunk Introspection logs are located in $SPLUNK_HOME/var/log/introspection. These logs record data about the impact of the Splunk software on the host system. This path is monitored by default, and the contents are sent to the _introspection index.
Now you: objective 9.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 2
You want to know which internal logs land in the _audit index on your search head. Which log is indexed there?
Sample question 2 of 2
An auditor needs evidence of failed logins, setting changes and saved searches run last month. What does audit.log record?
Full Enterprise Certified Architect question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.