Exam SPLK-3003 topic 1 question 44 discussion

C is correct https://wiki.splunk.com/Community:HowIndexingWorks

There is no such thing as a "merging" or "input" queue. There is the "input" pipeline that gets to the parsingQueue [utf8 processor, line breaker, header parsing], then to the aggregationQueue [date parsing and line merging], then typingQueue [regex replacement, punct:: addition], then to the indexQueue [tcp output, syslog output, http output, block signing, indexing, indexing metrics] and finally to disk.

I think it's A. A regex problem would cause the Typing queue to fill up first (answer C) BUT if this is a worst-case scenario then every queue before that (Parsing and Merging) would also get blocked. So it has to be more than just the Typing queue, and A is the only other one that fits. I'm assuming that when they say 'input', they mean that the forwarders would also not be able to send any more data to the Indexers so their queues would fill up as well

C, this is a tricky question. Indexing would not fill up because nothing would make it past the typing queue and input is not a queue. So therefore, the only logical answer is C.

If indexers are slogging because of a blockage in the Typing pipeline, then worst-case scenario means Typing, Merging, Parsing, and Input queues would soon be filling up, while the Indexing queue would be practically empty.

C is correct, refer https://wiki.splunk.com/Community:HowIndexingWorks typing pipeline

Agreed this is C

C is correct