Splunk Core Certified Advanced Power User — Question 90

When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

Answer options

• A. Enable indexer acknowledgment.
• B. Enable forwarder acknowledgment.
• C. splunk check-integrity -index <index name>
• D. index=_internal component=ACK | stats count by host

Correct answer: A

Explanation

Enabling indexer acknowledgment ensures that the events sent to the indexer are confirmed as indexed, providing a reliable method to track event status. Forwarder acknowledgment (option B) pertains to the communication between forwarders and indexers but does not guarantee indexing. The command in option C checks integrity rather than confirming indexing, while option D queries internal logs without directly addressing indexing assurance.