What is the primary purpose of Splunk-to-Splunk (S2S) communication?

To enable two Splunk instances to share configuration files and apps in real time

To replicate search results between Splunk instances for high availability

To allow one Splunk instance to send data to another Splunk instance over a dedicated TCP port

To provide a web-based interface for managing multiple Splunk instances from a single console

What is the purpose of indexer acknowledgment in S2S communication?

To compress data before transmission

To authenticate the forwarder to the indexer

To confirm that the indexer has received and indexed the data

A Splunk admin enables SSL on the indexer's `[splunktcp-ssl://9997]` stanza. The forwarder's outputs.conf is updated with `sslEnabled = true` and `sslVerifyServerCert = true`. The forwarder's splunkd.log shows 'SSL handshake failed: certificate verify failed'. The indexer's certificate is self-signed. What is the most likely fix?

Set `sslVerifyServerCert = false` on the forwarder.

Change the indexer to use `[splunktcp://9997]` instead of SSL.

Add the indexer's CA certificate to the forwarder's `sslCAFile` path.

Set `sslPassword = ` in the forwarder's outputs.conf.

A Splunk admin has a universal forwarder sending data to an indexer. The admin needs to send data to a second indexer only for a subset of the data (e.g., only security-related logs). The current outputs.conf has a single `[tcpout:primary]` group. What is the most efficient way to achieve this?

Use a deployment server to push different outputs.conf files to the forwarder.

Configure the second indexer as a search head and use distributed search.

Create a second `[tcpout:security]` group and use props.conf/transforms.conf to route security data to it.

Add the second indexer to the existing `[tcpout:primary]` server list.

A Splunk admin configures a heavy forwarder to send data to an indexer cluster with indexer acknowledgment enabled. The forwarder's outputs.conf includes `useACK = true`. After a network blip, the admin notices the forwarder's queue is growing and some events are being re-sent. What is the correct interpretation of this behavior?

The queue growth is caused by the indexer cluster being offline, not by the ACK mechanism.

The re-sending is expected because the forwarder didn't receive an ACK for the data sent before the blip.

The re-sending indicates a misconfiguration; useACK should be set to false to prevent duplicates.

The forwarder is sending to the wrong indexer port, causing the data to be rejected.

SplunkCore Certified Consultant

Domain 4Objective 2

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 3)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

15%of the exam

Questions 11–15

11foundation · easy
What is the primary purpose of Splunk-to-Splunk (S2S) communication?
Select an answer first
12foundation · easy
What is the purpose of indexer acknowledgment in S2S communication?
Select an answer first
13application · medium
A Splunk admin enables SSL on the indexer's `[splunktcp-ssl://9997]` stanza. The forwarder's outputs.conf is updated with `sslEnabled = true` and `sslVerifyServerCert = true`. The forwarder's splunkd.log shows 'SSL handshake failed: certificate verify failed'. The indexer's certificate is self-signed. What is the most likely fix?
Select an answer first
14expert · hard
A Splunk admin has a universal forwarder sending data to an indexer. The admin needs to send data to a second indexer only for a subset of the data (e.g., only security-related logs). The current outputs.conf has a single `[tcpout:primary]` group. What is the most efficient way to achieve this?
Select an answer first
15application · medium
A Splunk admin configures a heavy forwarder to send data to an indexer cluster with indexer acknowledgment enabled. The forwarder's outputs.conf includes `useACK = true`. After a network blip, the admin notices the forwarder's queue is growing and some events are being re-sent. What is the correct interpretation of this behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of Splunk-to-Splunk (S2S) communication?

What is the purpose of indexer acknowledgment in S2S communication?

A Splunk admin has a universal forwarder sending data to an indexer. The admin needs to send data to a second indexer only for a subset of the data (e.g., only security-related logs). The current outputs.conf has a single `[tcpout:primary]` group. What is the most efficient way to achieve this?

Keep studying — Data Collection