Splunk Enterprise Certified Admin Practice Test

Disable ads (and more) with a membership for a one time $4.99 payment

Question: 1 / 825

Which file must be modified to include useACK=true for ensuring indexer data reception?

props.conf

outputs.conf

The correct choice involves modifying outputs.conf to include useACK=true to ensure that data is properly received by the indexer. The useACK parameter is specifically related to acknowledgment settings in the forwarding configuration. When set to true in outputs.conf, this setting enables the forwarder to confirm that the data has been successfully received by the indexer, adding an additional layer of reliability to data transmission.

The other files mentioned have different roles:

- props.conf is used for source type definitions and can configure how data is parsed upon ingestion but does not handle acknowledgment settings.

- inputs.conf defines how data is received by Splunk, including monitoring paths for log files or data sources, but it does not manage acknowledgment for the forwarding process.

- checkpoints.conf is not typically modified for acknowledgment settings; this file is related to tracking the state of data inputs and managing the checkpoints of processed data.

Thus, modifying outputs.conf with useACK=true is crucial for ensuring that data sent from forwarders is acknowledged by the indexer, enabling effective and reliable data ingestion processes.

inputs.conf

checkpoints.conf

Next

Report this question