nerdexam
Splunk

SPLK-1003 · Question #66

Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

The correct answer is C. outputs.conf. outputs.conf is the Splunk configuration file that controls where data is forwarded, including internal logs from a search head to an indexer.

Splunk Forwarding

Question

Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

Options

  • Aprops.conf
  • Binputs.conf
  • Coutputs.conf
  • Dcollections.conf

How the community answered

(43 responses)
  • A
    2% (1)
  • C
    93% (40)
  • D
    5% (2)

Why each option

outputs.conf is the Splunk configuration file that controls where data is forwarded, including internal logs from a search head to an indexer.

Aprops.conf

props.conf manages source type parsing rules and field extraction configurations, with no role in defining forwarding destinations.

Binputs.conf

inputs.conf specifies data collection sources on the local host but does not control where collected data is sent.

Coutputs.confCorrect

outputs.conf defines tcpout stanzas that specify forwarding destinations and settings; a search head uses this file to route its internal index data (_internal, _audit) to a remote indexer, enabling centralized log collection and monitoring.

Dcollections.conf

collections.conf defines KV Store collection schemas used for lookup data storage and has no relation to log forwarding.

Concept tested: Splunk forwarder output destination configuration

Source: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

Topics

#Data Forwarding#Configuration Files#outputs.conf

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice