Which Splunk command or tool is commonly used to verify that a forwarder is successfully sending data to an indexer?

tcpdump on the indexer port 9997

A company has a Splunk deployment with a heavy forwarder that collects data from a legacy application and forwards it to a central indexer. The heavy forwarder also needs to send a copy of the same data to a second indexer in a different data center for disaster recovery. What is the most efficient way to configure this?

Set `forwardedindex.true = true` in the heavy forwarder's props.conf.

Add a second `[tcpout]` stanza with a different `server` setting in outputs.conf.

Configure the second indexer as a search head and use distributed search.

Use a deployment server to push the same outputs.conf to both indexers.

A Splunk admin has a forwarder sending data to an indexer with `useACK = true`. The admin notices that the forwarder's queue is consistently near capacity, and `ack_failures` in metrics.log is slowly increasing. The indexer is healthy and has plenty of resources. What is the most likely cause?

The network latency between the forwarder and indexer is high, slowing ACK delivery.

The forwarder's `maxQueueSize` is set too high.

The indexer's `maxConcurrentSearches` is too low.

The forwarder is sending data to the wrong index.

A Splunk admin needs to send data from a universal forwarder to an indexer. The indexer is listening on the default S2S port. The admin writes the following to outputs.conf: `[tcpout] defaultGroup = primary` and `[tcpout:primary] server = indexer.example.com:9997`. The forwarder restarts, but no data is sent. What is the most likely reason?

The `[tcpout]` stanza is missing `disabled = false`.

The `defaultGroup` must be set to `primary` inside the `[tcpout:primary]` stanza.

The `server` setting must use an IP address, not a hostname.

The forwarder has no inputs configured to generate data.

A Splunk admin is troubleshooting data loss. The forwarder's outputs.conf has `useACK = true`, but the admin notices that during a brief indexer outage, some events were never indexed. The forwarder's metrics.log shows `ack_failures` increasing. What is the most likely reason for the data loss?

The forwarder was configured with `useACK = false` on the indexer side.

The data was sent over UDP instead of TCP.

The forwarder's queue filled up and events were dropped before the indexer came back.

The indexer received the data but failed to write it to disk.

SplunkCore Certified Consultant

Domain 4Objective 2

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

15%of the exam

Questions 6–10

6foundation · easy
Which Splunk command or tool is commonly used to verify that a forwarder is successfully sending data to an indexer?
Select an answer first
7application · medium
A company has a Splunk deployment with a heavy forwarder that collects data from a legacy application and forwards it to a central indexer. The heavy forwarder also needs to send a copy of the same data to a second indexer in a different data center for disaster recovery. What is the most efficient way to configure this?
Select an answer first
8expert · hard
A Splunk admin has a forwarder sending data to an indexer with `useACK = true`. The admin notices that the forwarder's queue is consistently near capacity, and `ack_failures` in metrics.log is slowly increasing. The indexer is healthy and has plenty of resources. What is the most likely cause?
Select an answer first
9application · medium
A Splunk admin needs to send data from a universal forwarder to an indexer. The indexer is listening on the default S2S port. The admin writes the following to outputs.conf: `[tcpout] defaultGroup = primary` and `[tcpout:primary] server = indexer.example.com:9997`. The forwarder restarts, but no data is sent. What is the most likely reason?
Select an answer first
10application · medium
A Splunk admin is troubleshooting data loss. The forwarder's outputs.conf has `useACK = true`, but the admin notices that during a brief indexer outage, some events were never indexed. The forwarder's metrics.log shows `ack_failures` increasing. What is the most likely reason for the data loss?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Questions 6–10

Which Splunk command or tool is commonly used to verify that a forwarder is successfully sending data to an indexer?

A Splunk admin has a forwarder sending data to an indexer with `useACK = true`. The admin notices that the forwarder's queue is consistently near capacity, and `ack_failures` in metrics.log is slowly increasing. The indexer is healthy and has plenty of resources. What is the most likely cause?

A Splunk admin is troubleshooting data loss. The forwarder's outputs.conf has `useACK = true`, but the admin notices that during a brief indexer outage, some events were never indexed. The forwarder's metrics.log shows `ack_failures` increasing. What is the most likely reason for the data loss?

Keep studying — Data Collection