Splunk Enterprise Certified Admin Practice Test

Disable ads (and more) with a membership for a one time $2.99 payment

Prepare for the Splunk Enterprise Certified Admin Exam with flashcards and multiple choice questions. Each question includes hints and detailed explanations. Get ready to succeed!

Each practice test/flash card set has 50 randomly selected questions from a bank of over 500. You'll get a new set of questions each time!

Practice this question and more.


When a Universal Forwarder sends data via HTTP, does it support indexer acknowledgments by default?

  1. Yes

  2. No

  3. It requires manual configuration

  4. Only with useACK enabled

The correct answer is: No

When a Universal Forwarder sends data via HTTP, it does not support indexer acknowledgments by default. This means that when data is sent to the Splunk indexer, the forwarder does not wait for an acknowledgment that the data has been successfully received and indexed. This can affect data reliability, as the forwarder will not be aware of any issues that occurred during transmission. By default, the architecture is designed for efficient streaming of data where the focus is on performance rather than confirmation of data receipt. This allows for quicker data ingestion but comes at the potential cost of ensuring the integrity of that data in scenarios where network issues might arise. While there are methods to configure acknowledgment features within Splunk for other send methods or protocols, the HTTP communication channel between a Universal Forwarder and an indexer is inherently not designed to include this acknowledgment feature without further customization or enhancements. This makes it important to manage expectations regarding data delivery and reliability when utilizing HTTP for data transfer with Universal Forwarders.