The following stanzas in inputs.conf are currently being used by a deployment client: Which of the following statements is true of data that is received via this input?

The correct answer is B. If Splunk is restarted, data may be lost.. UDP is a connectionless, stateless protocol with no acknowledgment, flow control, or queuing mechanism. If Splunk is restarted while data is being sent over a UDP input, any data transmitted during the downtime is simply dropped - there is no queue or retry mechanism on the sendi

Splunk Forwarding

Question

The following stanzas in inputs.conf are currently being used by a deployment client:

Which of the following statements is true of data that is received via this input?

Exhibit

Options

AThe host value associated with data received will be the IP address that sent the data.
BIf Splunk is restarted, data may be lost.
CLocal firewall ports do not need to be opened on the deployment client since the port is defined in
DIf Splunk is restarted, data will be queued and then sent when Splunk has restarted.

How the community answered

(30 responses)

A
3% (1)
B
87% (26)
C
3% (1)
D
7% (2)

Explanation

UDP is a connectionless, stateless protocol with no acknowledgment, flow control, or queuing mechanism. If Splunk is restarted while data is being sent over a UDP input, any data transmitted during the downtime is simply dropped - there is no queue or retry mechanism on the sending side to hold data until Splunk recovers. This is a key distinction between UDP inputs and TCP inputs, which support persistent connections and can queue data during brief outages.

Topics

#inputs.conf#Data Ingestion#UDP Input#Data Loss

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice