Splunk Core Certified Advanced Power User — Question 39

Which of the following enables compression for universal forwarders in outputs.conf?

Answer options

• A. [udpout:mysplunk_indexer11] compression=true
• B. [tcpout] defaultGroup=my_indexers compressed=true
• C. /opt/splunkforwarder/bin/splunk enable compression
• D. [tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false

Correct answer: B

Explanation

The correct answer is B, as it specifically sets the 'compressed=true' option within the [tcpout] stanza, which is necessary for enabling compression. Option A is incorrect because it applies to UDP outputs and does not affect TCP. Option C is not a valid configuration within outputs.conf, and option D incorrectly states 'decompression=false' which does not enable compression.