Splunk SPLK-1003 Exam - Topic 9 Question 121 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 121
Topic #: 9

Load balancing on a Universal Forwarder is not scaling correctly. The forwarder's outputs. and the tcpout stanza are setup correctly. What else could be the cause of this scaling issue? (select all that apply)

AThe receiving port is not properly setup to listen on the right port.

BThe inputs . conf'S _SYSZOG_ROVTING is not setup to use the right group names.

CThe DNS record used is not setup with a valid list of IP addresses.

DThe indexAndForward value is not set properly.

Show Suggested Answer

Suggested Answer: A, C

The possible causes of the load balancing issue on the Universal Forwarder are A and C. The receiving port and the DNS record are both factors that affect the ability of the Universal Forwarder to distribute data across multiple receivers. If the receiving port is not properly set up to listen on the right port, or if the DNS record used is not set up with a valid list of IP addresses, the Universal Forwarder might fail to connect to some or all of the receivers, resulting in poor load balancing.

by Jacqueline at Nov 21, 2025, 02:05 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Margret

1 day ago

I feel like all options could be potential causes. Better to check everything.

upvoted 0 times

...

Colton

6 days ago

D should be checked too. If indexAndForward isn't set right, scaling won't work.

upvoted 0 times

...

Arlie

11 days ago

C is definitely a possibility. Invalid DNS can cause major routing issues.

upvoted 0 times

...

Vivienne

17 days ago

Agreed, A makes sense. But B might also be a problem if the group names are wrong.

upvoted 0 times

...

Audrie

22 days ago

I think A could be the issue. If the port isn't listening, nothing gets through.

upvoted 0 times

...

Albina

27 days ago

Wait, is it really possible for DNS to mess this up?

upvoted 0 times

...

Tayna

2 months ago

I agree with A and C, those are common mistakes.

upvoted 0 times

...

Twila

2 months ago

D seems off, but I’m not sure.

upvoted 0 times

...

Lashawn

2 months ago

I think C is a likely culprit too.

upvoted 0 times

...

Chandra

2 months ago

A could definitely be an issue.

upvoted 0 times

...

Estrella

2 months ago

Ah, the classic "select all that apply" question. Gotta love the Splunk exam writers and their love for tricky wording.

upvoted 0 times

...

Clay

2 months ago

Haha, the inputs._SYSZOG_ROVTING? What is this, a secret code? I think I'll just go with C and D and call it a day.

upvoted 0 times

...

Lyla

3 months ago

The receiving port? Really? That's like the first thing you'd check. Come on, people, let's use our heads here.

upvoted 0 times

...

Alba

3 months ago

Hmm, I'd double-check the inputs.conf settings just to be safe. Can't be too careful with these load balancing issues.

upvoted 0 times

...

Kallie

3 months ago

I vaguely recall that indexAndForward settings can impact performance, so D could be worth considering as well.

upvoted 0 times

...

Laura

3 months ago

I feel like DNS issues could also cause problems, so C might be a possibility, but I need to double-check that.

upvoted 0 times

...

Azalee

3 months ago

I’m not entirely sure, but I think the inputs.conf settings could definitely affect routing, so B could be relevant too.

upvoted 0 times

...

Orville

3 months ago

I remember something about the receiving port needing to be configured correctly, so A might be a valid option.

upvoted 0 times

...

Yuki

4 months ago

Hmm, the receiving port setup seems like a good place to start. I'll make sure it's listening on the correct port.

upvoted 0 times

...

Jarod

4 months ago

C and D seem like the most likely culprits here. Gotta make sure that DNS and indexAndForward are on point.

upvoted 0 times

...

Lorean

4 months ago

The indexAndForward value is an interesting option. I'll make sure that's configured correctly as well.

upvoted 0 times

...

Laticia

4 months ago

The DNS record could definitely be the culprit. I'll verify that the IP addresses are set up properly.

upvoted 0 times

...

Micah

5 months ago

I'm a bit confused by the question. Is the problem with the Universal Forwarder's outputs or the tcpout stanza? I'll need to double-check both.

upvoted 0 times

...

Hannah

5 months ago

This looks like a tricky one. I'll need to carefully review the configuration settings to identify the issue.

upvoted 0 times

Long

4 months ago

This is definitely tricky.

upvoted 0 times

...