Data can be onboarded using apps, Splunk Web, or the CLI. Which is the PS preferred method?

Question

Options

• ACreate UDP input port 9997 on a UF.
• BUse the add data wizard in Splunk Web.
• CUse the inputs.conf file.
• DUse a scripted input to monitor a log file.

• A
  3% (1)
• B
  3% (1)
• C
  86% (25)
• D
  7% (2)

Explanation

Using inputs.conf is the Professional Services (PS) preferred method because it is file-based, version-controllable, and deployable at scale via a deployment server - aligning with Splunk best practices for enterprise environments where consistency and repeatability matter.

Why the distractors are wrong:

• A is incorrect because UDP port 9997 is not a valid input type; port 9997 is actually used for Splunk-to-Splunk forwarding (TCP), not for creating UDP inputs on a Universal Forwarder.
• B (the add data wizard) is a GUI shortcut suitable for demos or quick testing, but it generates configurations that aren't easily reproduced or managed at scale - PS avoids this for production deployments.
• D (scripted inputs) are a legitimate but specialized mechanism for data sources that can't be monitored directly; they're not a general preferred method and carry higher maintenance overhead.

Memory tip: Think "PS = Production-Safe" - inputs.conf is the only option that lives in a config file you can commit to version control, deploy via apps, and manage across hundreds of forwarders without touching a GUI.

No community discussion yet for this question.