What is the primary purpose of the HTTP Event Collector (HEC) in Splunk?

To allow applications to send data to Splunk over HTTP/HTTPS

To provide a web interface for searching data

To collect data from remote files using a forwarder

To store data in a distributed manner across indexers

Which of the following is a primary method for getting data into a Splunk indexer?

Using the deployment server to push configuration to clients

Using the search head to pull data from external databases

Using a forwarder to send data to the indexer

Using the monitoring console to collect performance metrics from indexers

A Splunk administrator is investigating why some events from a network input are not being indexed. The network input is configured to listen on a TCP port. The administrator suspects that the data is being received but not parsed correctly. What should the administrator check first?

Check the inputs.conf file to ensure the network input is enabled.

Check the network input's connection queue size.

Check the indexer's disk space to ensure there is enough room for the new events.

Check the props.conf and transforms.conf configurations for the sourcetype assigned to the network input.

A Splunk administrator needs to ingest data from a custom application that writes data to a named pipe (FIFO) on the indexer host. Which direct input type should be used?

Network input configured to listen on a TCP port.

Monitor input configured to read from the named pipe.

HTTP Event Collector input configured to receive data from the application.

Scripted input that runs a command to read the named pipe.

A Splunk administrator notices that events from a new application are being indexed with incorrect timestamps. The application sends data via HEC with a timestamp field in the payload. The administrator wants to ensure the correct timestamp is used. What should the administrator do?

Configure the HEC token to use the 'timestamp' field from the payload as the event timestamp.

Configure a props.conf transform on the indexer to extract the timestamp from the raw event.

Configure a heavy forwarder to parse the HEC payload and rewrite the timestamp before sending to the indexer.

Configure the indexer to use the current time for all HEC events.

SplunkCore Certified Consultant

Domain 4Objective 1

Articulate the Different Ways Data Can Be Ingested by an Indexer CORE-CERTIFIED-CONSULTANT Practice Questions (Page 3)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

15%of the exam

Questions 11–15

11foundation · easy
What is the primary purpose of the HTTP Event Collector (HEC) in Splunk?
Select an answer first
12foundation · easy
Which of the following is a primary method for getting data into a Splunk indexer?
Select an answer first
13expert · hard
A Splunk administrator is investigating why some events from a network input are not being indexed. The network input is configured to listen on a TCP port. The administrator suspects that the data is being received but not parsed correctly. What should the administrator check first?
Select an answer first
14application · medium
A Splunk administrator needs to ingest data from a custom application that writes data to a named pipe (FIFO) on the indexer host. Which direct input type should be used?
Select an answer first
15application · medium
A Splunk administrator notices that events from a new application are being indexed with incorrect timestamps. The application sends data via HEC with a timestamp field in the payload. The administrator wants to ensure the correct timestamp is used. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.