Splunk Core Certified Advanced Power User — Question 89

Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

Answer options

• A. props.conf
• B. inputs.conf
• C. outputs.conf
• D. collections.conf

Correct answer: C

Explanation

The correct answer is C, outputs.conf, as this file is specifically used to define how Splunk forwards data to other components like indexers. The other options do not serve this purpose: props.conf is for data parsing, inputs.conf is for data input configurations, and collections.conf is used for managing collections.