When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

The correct answer is A. Enable indexer acknowledgment. Indexer acknowledgment (ACK) is the HEC feature that provides end-to-end delivery confirmation. When enabled, HEC returns an acknowledgment token to the sender upon receipt; the sender then polls the /acks endpoint to confirm the events were actually written to the index-not…

Splunk Indexing

Question

Options

AEnable indexer acknowledgment.
BEnable forwarder acknowledgment.
Csplunk check-integrity -index <index name>
Dindex=_internal component=ACK | stats count by host

How the community answered

(16 responses)

A
88% (14)
C
6% (1)
D
6% (1)

Explanation

Indexer acknowledgment (ACK) is the HEC feature that provides end-to-end delivery confirmation. When enabled, HEC returns an acknowledgment token to the sender upon receipt; the sender then polls the /acks endpoint to confirm the events were actually written to the index-not just received by the HEC endpoint. Without ACK enabled, a successful HTTP 200 response only confirms delivery to HEC, not that indexing completed. 'Forwarder acknowledgment' (B) is not a HEC concept, and the other options are unrelated to HEC delivery assurance.

Topics

#HTTP Event Collector (HEC)#Indexer Acknowledgment#Data Ingestion#Event Indexing Verification

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice