SPLK-1003 · Question #66
Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?
The correct answer is C. outputs.conf. outputs.conf is the Splunk configuration file that controls where data is forwarded, including internal logs from a search head to an indexer.
Question
Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?
Options
- Aprops.conf
- Binputs.conf
- Coutputs.conf
- Dcollections.conf
How the community answered
(43 responses)- A2% (1)
- C93% (40)
- D5% (2)
Why each option
outputs.conf is the Splunk configuration file that controls where data is forwarded, including internal logs from a search head to an indexer.
props.conf manages source type parsing rules and field extraction configurations, with no role in defining forwarding destinations.
inputs.conf specifies data collection sources on the local host but does not control where collected data is sent.
outputs.conf defines tcpout stanzas that specify forwarding destinations and settings; a search head uses this file to route its internal index data (_internal, _audit) to a remote indexer, enabling centralized log collection and monitoring.
collections.conf defines KV Store collection schemas used for lookup data storage and has no relation to log forwarding.
Concept tested: Splunk forwarder output destination configuration
Source: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf
Topics
Community Discussion
No community discussion yet for this question.