Which of the following accurately describes HTTP Event Collector indexer acknowledgement?

Question

Options

• AIt requires a separate channel provided by the client.
• BIt is configured the same as indexer acknowledgement used to protect in-flight data.
• CIt can be enabled at the global setting level.
• DIt stores status information on the Splunk server.

• A
  88% (30)
• B
  3% (1)
• C
  3% (1)
• D
  6% (2)

Explanation

Sending events to HEC with indexer acknowledgment active is similar to sending them with the setting off. There is one crucial difference: when you have indexer acknowledgment turned on, you must specify a channel when you send events. The concept of a channel was introduced in HEC primarily to prevent a fast client from impeding the performance of a slow client. When you assign one channel per client, because channels are treated equally on Splunk Enterprise, one client can't affect another. You must include a matching channel identifier both when sending data to HEC in an HTTP request and when requesting acknowledgment that events contained in the request have been indexed. If you don't, you will receive the error message, "Data channel is missing." Each request that includes a token for which indexer acknowledgment has been enabled must include a channel identifier, as shown in the following example cURL statement, where <data> represents the event data portion of the request

No community discussion yet for this question.