SPLK-1001 · Question #87
Three basic components of Splunk are (Choose three.):
The correct answer is A. Forwarders C. Indexer F. Search Head. Splunk's three fundamental architectural components are Forwarders (A), Indexers (C), and Search Heads (F) - together they form the classic data pipeline: collect, store, and search. Forwarders gather and ship raw data to the indexer; the Indexer parses, stores, and indexes…
Question
Three basic components of Splunk are (Choose three.):
Options
- AForwarders
- BDeployment Server
- CIndexer
- DKnowledge Objects
- EIndex
- FSearch Head
How the community answered
(21 responses)- A71% (15)
- B5% (1)
- D10% (2)
- E14% (3)
Explanation
Splunk's three fundamental architectural components are Forwarders (A), Indexers (C), and Search Heads (F) - together they form the classic data pipeline: collect, store, and search. Forwarders gather and ship raw data to the indexer; the Indexer parses, stores, and indexes that data; and the Search Head provides the UI and processing layer where users run queries against the indexed data.
Why the distractors are wrong:
- B (Deployment Server) is a management/configuration tool for pushing configs to forwarders - useful, but not a core architectural component.
- D (Knowledge Objects) are user-created enrichments (field extractions, tags, lookups) that live on the Search Head - they're a feature, not a component.
- E (Index) is a data store within the Indexer, not a component itself - it's what the Indexer manages.
Memory tip: Think F-I-S (Forwarder → Indexer → Search Head) as the three-stage data journey: Feed it, Index it, Search it.
Community Discussion
No community discussion yet for this question.