Splunk Core Certified Advanced Power User — Question 49

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

Answer options

• A. inputs.conf
• B. indexes.conf
• C. outputs.conf
• D. servers.conf

Correct answer: C

Explanation

The command 'splunk add forward-server' is used to configure a forwarder to send data to a specified indexer, which requires entries in the outputs.conf file. Options A and B are incorrect because inputs.conf is for defining data inputs on the local instance, and indexes.conf is for index configuration. Option D is also incorrect as servers.conf is not the correct configuration file for this command.