Splunk Core Certified Advanced Power User — Question 164

Which of the following is an alternative method to manually editing the outputs.conf file on the forwarder to send data?

Answer options

• A. Run the splunk add servercommand on each indexer.
• B. Run the splunk add forward-indexercommand for each indexer.
• C. Run the splunk add forwardercommand on each indexer.
• D. Run the splunk add forward-servercommand for each indexer.

Correct answer: D

Explanation

The correct option, D, is the appropriate command to add a forwarder to each indexer without needing to edit the outputs.conf file directly. The other options either reference incorrect commands or do not pertain to setting up forwarding correctly.