Splunk Enterprise Certified Architect — Question 57

When determining where a Splunk forwarder is trying to send data, which of the following searches can provide assistance?

Answer options

• A. index=_internal sourcetype=internal metrics destHost | dedup destHost
• B. index=_metrics sourcetype=splunkd metrics destHost | dedup destHost
• C. index=_internal sourcetype=splunkd metrics destHost | dedup destHost
• D. index=_internal sourcetype=splunkd metrics inputHost | dedup inputHost

Correct answer: C

Explanation

The correct answer, C, utilizes the appropriate sourcetype and index to retrieve metrics related to the Splunk forwarder, specifically targeting the destination host. Options A and B use incorrect sourcetypes or indexes that do not specifically relate to the forwarder's metrics. Option D focuses on inputHost rather than destHost, making it less relevant for determining where data is sent.