Splunk Core Certified Advanced Power User — Question 146

A company moves to a distributed architecture to meet the growing demand for the use of Splunk. What parameter can be configured to enable automatic load balancing in the Universal Forwarder to send data to the indexers?

Answer options

• A. Splunk does not do load balancing and requires a hardware load balancer to balance traffic across the indexers.
• B. Create one outputs.conf file for each of the server addresses in the indexing tier.
• C. Set the tcpout :my_splunk_indexers stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment.
• D. Configure the outputs.conf file to point to any server in the indexing tier and Splunk will configure the data to be sent to all of the indexers.

Correct answer: C

Explanation

The correct answer is C because setting the tcpout stanza with a list of indexer addresses enables the Universal Forwarder to distribute data load among those indexers automatically. Option A is incorrect as Splunk can manage load balancing without external hardware. Option B suggests creating separate configurations which is unnecessary for load balancing, and option D implies a less effective method of distributing data compared to the specified configuration in C.