SplunkSplunk
SPLK-1003 · Question #67
SPLK-1003 Question #67: Real Exam Question with Answer & Explanation
The correct answer is A: Enable indexer acknowledgment.. While HEC has precautions in place to prevent data loss, it's impossible to completely prevent such an occurrence, especially in the event of a network failure or hardware crash. This is where indexer acknolwedgment comes in.
Splunk Indexing
Question
When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?
Options
- AEnable indexer acknowledgment.
- BEnable forwarder acknowledgment.
- Csplunk check-integrity -index <index name>
- Dindex=_internal component=ACK | stats count by host
Explanation
While HEC has precautions in place to prevent data loss, it's impossible to completely prevent such an occurrence, especially in the event of a network failure or hardware crash. This is where indexer acknolwedgment comes in.
Topics
#HTTP Event Collector (HEC)#Indexer Acknowledgment#Data Ingestion#Event Indexing Verification
Community Discussion
No community discussion yet for this question.