Splunk Core Certified Advanced Power User — Question 152

Load balancing on a Universal Forwarder is not scaling correctly. The forwarder’s outputs.conf and the tcpout stanza are setup correctly. What else could be the cause of this scaling issue? (Choose all that apply.)

Answer options

• A. The indexAndForward value is not set properly.
• B. The DNS record used is not setup with a valid list of IP addresses.
• C. The inputs.conf’s _SYSLOG_ROUTING is not setup to use the right group names.
• D. The receiving port is not properly setup to listen on the right port.

Correct answer: B, D

Explanation

Option B is correct because if the DNS record does not have a valid list of IP addresses, it can prevent proper load balancing. Option D is also correct as an improperly configured receiving port will hinder the forwarder's ability to direct traffic correctly. Options A and C are not relevant to the load balancing issue described in this scenario.