The following stanzas in inputs. conf are currently being used by a deployment client: Which of the following statements is true of data that is received via this input?

The correct answer is B. If Splunk is restarted, data may be lost.. UDP is a connectionless, fire-and-forget protocol with no built-in delivery guarantees or buffering. If Splunk restarts while a UDP input is active, any data sent to that port during the restart window is simply dropped - there is no queue, no acknowledgment, and no retransmissio

Splunk Forwarding

Question

The following stanzas in inputs. conf are currently being used by a deployment client:

Which of the following statements is true of data that is received via this input?

Exhibit

Options

ALocal firewall ports do not need to be opened on the deployment client since the port is defined in
BIf Splunk is restarted, data may be lost.
CIf Splunk is restarted, data will be queued and then sent when Splunk has restarted.
DThe host value associated with data received will be the IP address that sent the data.

How the community answered

(36 responses)

A
3% (1)
B
92% (33)
C
6% (2)

Explanation

UDP is a connectionless, fire-and-forget protocol with no built-in delivery guarantees or buffering. If Splunk restarts while a UDP input is active, any data sent to that port during the restart window is simply dropped - there is no queue, no acknowledgment, and no retransmission. This contrasts with TCP inputs (answer C), where OS-level TCP buffers and retransmission can preserve in-flight data across a brief restart. Answer A is incorrect because local firewall rules are OS-level and must be configured separately regardless of inputs.conf. Answer D is incorrect; the host metadata for UDP defaults to the DNS name or IP of the sending host, but this is configurable.

Topics

#inputs.conf#UDP input#Data loss#Input persistence

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice