Articulate the Different Ways Data Can Be Ingested by an Indexer CORE-CERTIFIED-CONSULTANT Practice Questions (Page 5)

Questions 21–23

1. 21foundation · easy

   Which of the following is required to send data to Splunk using HEC?

   • AA network input configured on the indexer
   • BA universal forwarder installed on the application server
   • CA heavy forwarder to parse the data
   • DA valid HEC token
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A development team wants to send application metrics to Splunk from a cloud function that runs for a few seconds. The team wants to use a simple HTTP POST with a token and does not want to manage any Splunk software. Which ingestion method should they use?

   • AUse a network input on the indexer to listen for UDP packets from the cloud function.
   • BConfigure a scripted input on the indexer to pull metrics from the cloud function.
   • CInstall a universal forwarder in the cloud function and use a monitor input.
   • DUse the Splunk HTTP Event Collector (HEC) endpoint with a token.
   Reveal Solution Discussion Select an answer first
3. 23expert · hard

   A company uses both universal forwarders and HEC to send data to Splunk. They want to ensure reliable delivery for both methods. Which statement is true regarding indexer acknowledgment?

   • AIndexer acknowledgment is only available for HEC, not for forwarders.
   • BIndexer acknowledgment is automatically enabled for all ingestion methods.
   • CIndexer acknowledgment is only available for forwarders, not for HEC.
   • DIndexer acknowledgment can be used with both forwarders and HEC, but the configuration and behavior differ.
   Reveal Solution Discussion Select an answer first