Splunk Core Certified Advanced Power User — Question 158

A Universal Forwarder is monitoring a very active syslog stream and as a result is unable to switch between destinations. How would an admin safely remediate this issue?

Answer options

• A. Configure forceTimebasedAutoLB on the forwarder.
• B. Configure useAck on the forwarder.
• C. Configure and enable the EVENT_BREAKER on the forwarder.
• D. Configure and enable the LINE_BREAKER on the forwarder.

Correct answer: A

Explanation

The correct answer is A, as configuring forceTimebasedAutoLB on the forwarder allows it to balance load based on time, which can help manage high volumes of data more effectively. The other options, while related to data processing, do not specifically address the issue of switching between destinations in the context of a very active syslog stream.