After sending test data to a UDP input, where should you look to verify that the data was received and indexed correctly?

Look at the Windows Event Viewer

Check the forwarder's outputs.conf

Search in Splunk for the test data

An admin is investigating a slowdown in data ingestion. The indexer's CPU is low, but the `index_queue` in metrics.log shows a high number of entries. What does this indicate?

The indexer's CPU is too high, causing the queue to back up.

There is a network bottleneck between forwarders and the indexer.

The indexer is receiving data faster than it can write to disk.

The forwarders are not sending data fast enough.

A consultant is troubleshooting why events from a new data source are appearing with the wrong source type. The inputs.conf on the forwarder specifies a source type, but the events still show as 'unknown'. What should the consultant check first?

The permissions on the input file.

The forwarder's outputs.conf for indexer routing.

The props.conf on the indexer for a source type override.

The network connectivity to the indexer.

A Splunk environment has multiple forwarders sending data to a single indexer. The admin notices that the indexer's `index_queue` is frequently full, and events are being dropped. The forwarders' `input queues` are also high. The admin suspects a bottleneck. What is the most effective first step to diagnose the bottleneck?

Check the indexer's metrics.log for `index_queue` and `typing_queue` values.

Increase the forwarders' output queue sizes.

Reduce the number of forwarders sending data.

Check the forwarders' splunkd.log for connection errors.

A forwarder is not sending data for a newly added monitor input. The admin verifies the file exists and has data, and the forwarder can reach the indexer. What should the admin check next in the forwarder's inputs.conf?

Check the `[tcpout]` stanza in outputs.conf.

Confirm the forwarder's server.conf has the correct hostname.

Ensure the `[monitor:// ]` stanza is present and the path is correct.

Verify the indexer's indexes.conf has the target index defined.

SplunkCore Certified Consultant

Domain 4Objective 4

Describe Ways to Troubleshoot Data Inputs CORE-CERTIFIED-CONSULTANT Practice Questions (Page 3)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

15%of the exam

Questions 11–15

11foundation · easy
After sending test data to a UDP input, where should you look to verify that the data was received and indexed correctly?
Select an answer first
12application · medium
An admin is investigating a slowdown in data ingestion. The indexer's CPU is low, but the `index_queue` in metrics.log shows a high number of entries. What does this indicate?
Select an answer first
13application · medium
A consultant is troubleshooting why events from a new data source are appearing with the wrong source type. The inputs.conf on the forwarder specifies a source type, but the events still show as 'unknown'. What should the consultant check first?
Select an answer first
14expert · hard
A Splunk environment has multiple forwarders sending data to a single indexer. The admin notices that the indexer's `index_queue` is frequently full, and events are being dropped. The forwarders' `input queues` are also high. The admin suspects a bottleneck. What is the most effective first step to diagnose the bottleneck?
Select an answer first
15application · medium
A forwarder is not sending data for a newly added monitor input. The admin verifies the file exists and has data, and the forwarder can reach the indexer. What should the admin check next in the forwarder's inputs.conf?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.