A Universal Forwarder is monitoring a very active syslog stream and as a result is unable to switch between destinations. How would an admin safely remediate this issue?

The correct answer is B. Configure useAck on the forwarder.. Configuring 'useAck = true' (indexer acknowledgment) enables the forwarder to receive explicit confirmation from an indexer that data has been committed. This allows the forwarder to safely remove data from its send queue and switch to a new destination without risking data loss

Splunk Forwarding

Question

Options

AConfigure forceTimebasedAutoLB on the forwarder.
BConfigure useAck on the forwarder.
CConfigure and enable the EVENT_BREAKER on the forwarder.
DConfigure and enable the LINE_BREAKER on the forwarder.

How the community answered

(45 responses)

A
7% (3)
B
76% (34)
C
13% (6)
D
4% (2)

Explanation

Configuring 'useAck = true' (indexer acknowledgment) enables the forwarder to receive explicit confirmation from an indexer that data has been committed. This allows the forwarder to safely remove data from its send queue and switch to a new destination without risking data loss during the transition. On a very active syslog stream, without acknowledgment, the forwarder cannot safely determine which data was successfully received before switching, creating a risk of duplication or loss. 'forceTimebasedAutoLB' changes when switching occurs but does not make the switch safe. EVENT_BREAKER and LINE_BREAKER relate to event parsing, not load balancing or failover safety.

Topics

#Universal Forwarder#Data Reliability#Output Management#useAck

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice