Splunk Core Certified Advanced Power User — Question 86

After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

Answer options

• A. index=main
• B. index=test
• C. index=summary
• D. index=_internal

Correct answer: D

Explanation

The correct answer is D, index=_internal, because it contains logs and metrics about the internal processes of Splunk, including information on forwarder connections. The other options, such as index=main, index=test, and index=summary, do not provide insights into the status of the universal forwarder connection.