(When determining where a Splunk forwarder is trying to send data, which of the following searches can provide assistance?)

Question

Options

• Aindex=_internal sourcetype=internal metrics destHost | dedup destHost
• Bindex=_internal sourcetype=splunkd metrics inputHost | dedup inputHost
• Cindex=_metrics sourcetype=splunkd metrics destHost | dedup destHost
• Dindex=_internal sourcetype=splunkd metrics destHost | dedup destHost

• A
  5% (2)
• B
  12% (5)
• C
  7% (3)
• D
  76% (31)

Explanation

To determine where a Splunk forwarder is attempting to send its data, administrators can search within the _internal index using the metrics logs generated by the forwarder's Splunkd process. The correct and documented search is: index=_internal sourcetype=splunkd metrics destHost | dedup destHost The _internal index contains detailed operational logs from the Splunkd process, including metrics on network connections, indexing pipelines, and output groups. The field destHost records the destination indexer(s) to which the forwarder is attempting to send data. Using dedup destHost ensures that only unique destination hosts are shown. This search is particularly useful for troubleshooting forwarding issues, such as connection failures, misconfigurations in outputs.conf, or load-balancing behavior in multi-indexer setups. Other listed options are invalid or incorrect because: sourcetype=internal does not exist. index=_metrics is not where Splunk stores forwarding telemetry. The field inputHost identifies the source host, not the destination. Thus, Option D aligns with Splunk's official troubleshooting practices for forwarder-to-indexer communication validation. - Monitoring Forwarder Connections and Destinations - Troubleshooting Forwarding Using Internal Logs - _internal Index Reference - Metrics and destHost Fields - outputs.conf - Verifying Forwarder Data Routing and Connectivity

No community discussion yet for this question.