Splunk Enterprise Security Certified Analyst — Question 64

What is required to setup the HTTP Event Collector (HEC)?

Answer options

• A. Each HEC input requires a unique name but token values can be shared.
• B. Each HEC input requires an existing forwarder output group.
• C. Each HEC input entry must contain a valid token.
• D. Each HEC input requires a Source name field.

Correct answer: C

Explanation

The correct answer is C because each HEC input must indeed include a valid token for authentication and data submission. Options A, B, and D are incorrect as they do not represent essential requirements for HEC setup; names, output groups, and source fields are not mandatory for every input entry.