An admin is using the Monitoring Console to review input health. They see that the `input queue` on a heavy forwarder is consistently near 100% capacity. What does this indicate?

The forwarder's disk is full, preventing it from reading files.

The indexer is indexing data faster than the forwarder can send.

The forwarder's CPU is too high, slowing down the input process.

The forwarder is reading data faster than it can send to the indexer.

A universal forwarder is configured to monitor a log file, but no data is appearing in Splunk. The forwarder's splunkd.log shows 'Permission denied' for the file. What is the most likely cause and solution?

The source type is misconfigured; change it in inputs.conf.

The forwarder is not connected to the indexer; check outputs.conf.

The forwarder's service account lacks read permission on the file; grant read access to the account.

The file is too large; split it into smaller files.

A consultant is testing a UDP input on a Splunk indexer. They send a test message using `echo 'test' | nc -u 514`, but the event does not appear in Splunk. What is the most likely reason?

The test message is too short to be indexed.

The UDP port is not open or the input is not configured in inputs.conf.

The source type is not defined for UDP events.

The indexer is not listening on UDP because it only supports TCP.

A consultant is troubleshooting a heavy forwarder that is not indexing Windows Event Logs. The inputs.conf on the forwarder looks correct, and the forwarder can reach the indexer. When the consultant runs `tcp` to send a test event to the indexer's port, the event appears with the correct source type. However, no Windows Event Log data is appearing. What is the most likely cause?

The source type for Windows Event Logs is not defined in props.conf on the indexer.

The indexer's inputs.conf is missing a `[splunktcp]` stanza.

The forwarder's local Windows Event Log permissions are insufficient.

The forwarder's outputs.conf is pointing to the wrong indexer port.

SplunkCore Certified Consultant

Domain 4Objective 4

Describe Ways to Troubleshoot Data Inputs CORE-CERTIFIED-CONSULTANT Practice Questions (Page 4)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

15%of the exam

Questions 16–20

16application · medium
An admin is using the Monitoring Console to review input health. They see that the `input queue` on a heavy forwarder is consistently near 100% capacity. What does this indicate?
Select an answer first
17application · medium
A universal forwarder is configured to monitor a log file, but no data is appearing in Splunk. The forwarder's splunkd.log shows 'Permission denied' for the file. What is the most likely cause and solution?
Select an answer first
18application · medium
A consultant is testing a UDP input on a Splunk indexer. They send a test message using `echo 'test' | nc -u <indexer> 514`, but the event does not appear in Splunk. What is the most likely reason?
Select an answer first
19application · medium
A consultant is troubleshooting a heavy forwarder that is not indexing Windows Event Logs. The inputs.conf on the forwarder looks correct, and the forwarder can reach the indexer. When the consultant runs `tcp` to send a test event to the indexer's port, the event appears with the correct source type. However, no Windows Event Log data is appearing. What is the most likely cause?
Select an answer first
20foundation · easy
Which Splunk dashboard or view is specifically designed to monitor the health and performance of data inputs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Describe Ways to Troubleshoot Data Inputs CORE-CERTIFIED-CONSULTANT Practice Questions (Page 4)

Questions 16–20

An admin is using the Monitoring Console to review input health. They see that the `input queue` on a heavy forwarder is consistently near 100% capacity. What does this indicate?

A universal forwarder is configured to monitor a log file, but no data is appearing in Splunk. The forwarder's splunkd.log shows 'Permission denied' for the file. What is the most likely cause and solution?

A consultant is testing a UDP input on a Splunk indexer. They send a test message using `echo 'test' | nc -u <indexer> 514`, but the event does not appear in Splunk. What is the most likely reason?

Which Splunk dashboard or view is specifically designed to monitor the health and performance of data inputs?

Keep studying — Data Collection