Articulate the Different Ways Data Can Be Ingested by an Indexer CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which forwarder type can parse data before sending it to an indexer?

   • ALight forwarder
   • BHeavy forwarder
   • CIndexer forwarder
   • DUniversal forwarder
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a direct input that can be configured on an indexer?

   • ADashboard input
   • BForwarder input
   • CMonitor input
   • DSearch input
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A small company runs a single Splunk indexer that also needs to collect syslog data from network devices. The devices can only send syslog over UDP. The architect wants to avoid deploying additional forwarders. Which configuration should be used?

   • AConfigure a universal forwarder on each network device to forward syslog to the indexer.
   • BConfigure a scripted input on the indexer to run a syslog collector script.
   • CConfigure a monitor input on the indexer to watch a file where the devices write syslog.
   • DConfigure a UDP network input on the indexer to listen for syslog data.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SaaS application hosted outside the corporate network needs to send structured application logs to a Splunk indexer. The application team wants to use a simple HTTPS POST without installing any Splunk software. Which ingestion method should the architect recommend?

   • AConfigure a scripted input on the indexer that periodically pulls logs from the application via an API.
   • BConfigure a universal forwarder on the application server and use a monitor input to read the application log file.
   • CConfigure a network input on the indexer to listen for TCP data from the application.
   • DConfigure the application to send events to the Splunk HTTP Event Collector (HEC) endpoint using a token.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An application needs to send JSON events directly to a Splunk indexer over HTTPS. Which ingestion method is designed for this purpose?

   • AMonitor input on the indexer
   • BHTTP Event Collector (HEC)
   • CUniversal forwarder
   • DScript input on the indexer
   Reveal Solution Discussion Select an answer first