nerdexam
Splunk

SPLK-1003 · Question #165

Given a forwarder with the following outputs.conf configuration: [tcpout : mypartner] Server = 145.188.183.184:9097 [tcpout : hfbank] server = inputsl . mysplunkhfs . corp : 9997 , inputs2…

The correct answer is A. Data will continue to flow to hfbank if 145.1 g a) 183.184 : 9097 is unreachable. In outputs.conf, [tcpout:mypartner] and [tcpout:hfbank] are two separate, independent target groups. Splunk forwards data to each target group independently, so if mypartner (145.188.183.184:9097) becomes unreachable, data will continue flowing to hfbank uninterrupted. Answer A…

Splunk Forwarding

Question

Given a forwarder with the following outputs.conf configuration:

[tcpout : mypartner] Server = 145.188.183.184:9097 [tcpout : hfbank] server = inputsl . mysplunkhfs . corp : 9997 , inputs2 . mysplunkhfs . corp : 9997 Which of the following is a true statement?

Options

  • AData will continue to flow to hfbank if 145.1 g a) 183.184 : 9097 is unreachable.
  • BData is not encrypted to mypartner because 145.188 .183.184 : 9097 is specified by IP.
  • CData is encrypted to mypartner because 145.183.184 : 9097 is specified by IP.
  • DData will eventually stop flowing everywhere if 145.188.183.184 : 9097 is unreachable.

How the community answered

(36 responses)
  • A
    75% (27)
  • B
    8% (3)
  • C
    3% (1)
  • D
    14% (5)

Explanation

In outputs.conf, [tcpout:mypartner] and [tcpout:hfbank] are two separate, independent target groups. Splunk forwards data to each target group independently, so if mypartner (145.188.183.184:9097) becomes unreachable, data will continue flowing to hfbank uninterrupted. Answer A is correct. Answers B and C are both wrong because encryption in Splunk is controlled by SSL configuration settings (e.g., sslCertPath, useSSL), not by whether a server is addressed by IP or hostname. Answer D is incorrect because the two target groups are completely independent of each other - a failure in one does not affect the other.

Topics

#Splunk Forwarding#outputs.conf#Output Groups#Forwarder Resiliency

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice