Splunk Enterprise Certified Admin — Question 2

How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)

Answer options

• A. No need to do anything, it is turned on by default.
• B. When a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1.
• C. When a new HEC token is created in Splunk Web, select the checkbox labeled ג€Enable indexer acknowledgementג€.
• D. When the Global Settings for HEC are updated in Splunk Web, select the checkbox labeled ג€Enable indexer acknowledgementג€.

Correct answer: C, D

Explanation

The correct answers, C and D, involve directly enabling indexer acknowledgement through the Splunk Web interface during token creation or Global Settings updates. Option A is incorrect because indexer acknowledgement is not enabled by default, and option B is misleading as it does not apply to the HEC token creation process in that manner.