Splunk Enterprise Certified Admin Practice Test

What is the first step in configuring a universal forwarder?

1. Download and install UF

2. Set up receiving port on each indexer

3. Set up forwarding on each forwarder

4. Add inputs on forwarders

The correct answer is: Set up receiving port on each indexer

The correct approach to configuring a universal forwarder begins with downloading and installing the universal forwarder. This is essential because the forwarder must be deployed on the systems from which you want to collect logs and forward data to a receiving indexer. Once the universal forwarder is installed on the designated servers, it can be configured to forward data. Setting up a receiving port on each indexer is important for ensuring that the indexers can accept data from the forwarders. However, this step typically follows the installation of the universal forwarder, as the forwarder needs to be in place first to send data to the indexers. After installation, configuring the forwarding settings on each forwarder involves specifying the destination indexers and the ports to which data should be sent. Adding inputs on forwarders is also an integral aspect of the setup, as inputs define what data will be collected and forwarded. In summary, while setting up the receiving port is a necessary part of the configuration process, it cannot be the first step because the universal forwarder must first be in place to interact with the indexers effectively.