The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are…

Question

Options

• AIndexers, search head, universal forwarders, license master
• BIndexers, search head, deployment server, universal forwarders
• CIndexers, search head, deployment server, license master, universal forwarder
• DIndexers, search head, deployment server, license master, universal forwarder, heavy forwarder

• A
  12% (8)
• B
  4% (3)
• C
  81% (54)
• D
  3% (2)

Explanation

For this distributed deployment: Universal forwarders collect data from all 250 servers; multiple indexers receive and store the high volume of data; a search head provides the user-facing search interface; a deployment server manages forwarder configurations at scale across hundreds of clients; and a license master centrally manages licensing in a distributed environment. Heavy forwarders (option D) are not required here because universal forwarders handle standard log collection adequately. They would only be needed if intermediate parsing or routing logic were required before indexing.

No community discussion yet for this question.