SPLK-2002(205Q) · Question #62
Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)
A (telnet) and B (tcpdump) are correct. Both are standard network diagnostic tools used to troubleshoot the TCP connection between a Splunk forwarder and indexer (default port 9997). Running telnet <indexer_ip> 9997 quickly confirms whether the port is reachable, while tcpdump…
Question
Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)
Options
- Atelnet
- Btcpdump
- Csplunk btool
- Dsplunk btprobe
Explanation
A (telnet) and B (tcpdump) are correct. Both are standard network diagnostic tools used to troubleshoot the TCP connection between a Splunk forwarder and indexer (default port 9997). Running telnet <indexer_ip> 9997 quickly confirms whether the port is reachable, while tcpdump captures live packet traffic to reveal deeper issues like handshake failures, resets, or dropped packets.
C (splunk btool) is wrong because btool is a configuration inspection utility - it merges and displays Splunk config files to help identify misconfigured settings, but it does not test or probe live network connections.
D (splunk btprobe) is wrong because btprobe is not a real Splunk CLI command. This is a distractor designed to sound plausible by mimicking the btool naming convention.
Memory tip: Think "network problems need network tools" - telnet tests if the door (port) is open, tcpdump watches who walks through it. Splunk's own bt* commands live inside Splunk's config layer, not the network layer.
Topics
Community Discussion
No community discussion yet for this question.