Splunk
SPLK-3003 · Question #41
In the diagrammed environment shown below, the customer would like the data read by the universal forwarders to set an indexed field containing the UF's host name. Where would the parsing…
The correct answer is D. On all parsing Splunk instances. https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Configureindex-timefieldextraction
Data Ingestion and Configuration
Question
In the diagrammed environment shown below, the customer would like the data read by the universal forwarders to set an indexed field containing the UF's host name. Where would the parsing configurations need to be installed for this to work?
Exhibit
Options
- AAll universal forwarders.
- BOnly the indexers.
- CAll heavy forwarders.
- DOn all parsing Splunk instances.
How the community answered
(44 responses)- A5% (2)
- B11% (5)
- C5% (2)
- D80% (35)
Explanation
https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Configureindex-timefieldextraction
Topics
#universal forwarders#indexed fields#parsing configuration#heavy forwarders
Community Discussion
No community discussion yet for this question.