Splunk Enterprise Certified Admin Practice Test

Which command can help verify successful connection between the forwarder and indexer?

1. splunk show connection

2. search 'index=_internal host=forwarder_hostname'

3. splunk verify connection

4. splunk check status

The correct answer is: search 'index=_internal host=forwarder_hostname'

The command that helps verify successful connection between the forwarder and indexer is searching the internal index for logs where the host is specified as the forwarder's hostname. This command utilizes the internal logs collected by Splunk, specifically the `_internal` index, which contains critical operational logs and metrics for both the indexer and forwarders. When a forwarder sends data to an indexer, logs related to the connection can typically be found in the `_internal` index. By performing this search, one can ascertain whether the specific forwarder is successfully sending data and is properly recognized by the indexer. Successful results indicate that the data flow is operational, while absence of relevant logs indicates potential issues in communication or connection. Other options do not serve the same purpose. For example, commands like "splunk show connection," "splunk verify connection," or "splunk check status" may sound relevant but are not standard or widely recognized Splunk commands for this specific use case. The search within the internal index provides a definitive method for verifying connectivity and data transfer status between the forwarder and indexer, making it the correct choice in this scenario.