Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on?…

Question

Options

• AIdentify number of scheduled or real-time searches.
• BValidate if this Technical Add-On enables event data for a data model.
• CIdentify the maximum number of forwarders Technical Add-On can support.
• DVerify if Technical Add-On needs to be installed onto both a search head or indexer.

Explanation

B and D are correct. Before installing a vendor-built Technical Add-On, you must validate whether it enables CIM-compliant field extractions for data model acceleration (B), because without proper tagging your data won't integrate with Splunk's Common Information Model or apps like Enterprise Security. You must also verify the correct installation topology (D) - TAs often need to be placed on specific components (forwarder, indexer, and/or search head) depending on whether they handle input collection, parsing, or knowledge objects.

A is a distractor because the number of scheduled/real-time searches is a search performance concern, not a TA evaluation criterion - you assess that separately when tuning your environment. C is a distractor because the concept of a "maximum number of forwarders a TA can support" doesn't exist in Splunk; TAs are deployed to components, not limited per-forwarder count.

Memory tip: Think "What does it DO, and WHERE does it go?" - B covers function (does it feed a data model?) and D covers placement (which Splunk components need it). Those two questions are your TA checklist.

No community discussion yet for this question.