Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)

Question

Options

• AUse TCP syslog.
• BConfigure UDP inputs on each Splunk indexer to receive data directly.
• DUse one or more syslog servers to persist data with a Universal Forwarder to send the data to

Explanation

Both A and D are correct answers for improving syslog reliability to Splunk.

TCP syslog (A) is reliable because it is a connection-oriented protocol that guarantees packet delivery through acknowledgment and retransmission - unlike UDP, which fires packets with no confirmation they arrived. Using a syslog server with a Universal Forwarder (D) adds a persistence layer: the syslog server writes data to disk first, so even if Splunk is temporarily unavailable, no data is lost; the UF then reliably forwards stored data using its built-in acknowledgment mechanism.

Option B is wrong because UDP inputs on indexers combine two unreliability risks: UDP itself drops packets silently, and sending directly to indexers bypasses the forwarder's store-and-forward buffering, meaning any indexer outage causes data loss.

Memory tip: Think "reliable delivery = TCP + disk buffer." TCP = guaranteed transport; syslog server + UF = guaranteed persistence. If either the network or Splunk hiccups, you're covered. UDP direct-to-indexer is the worst of both worlds - no transport guarantees and no buffering.

No community discussion yet for this question.