Discuss Splunk SPLK-2002 Exam Topic 15 Question 54

Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)

AUse TCP syslog.

BConfigure UDP inputs on each Splunk indexer to receive data directly.

CUse a network load balancer to direct syslog traffic to active backend syslog listeners.

DUse one or more syslog servers to persist data with a Universal Forwarder to send the data to Splunk indexers.

Suggested Answer: C, D

Get Premium SPLK-2002 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Raul 11 months ago

C sounds good, but how does it handle failover?

Crista 11 months ago

A is a must, TCP is way more reliable!

Leslie 12 months ago

Surprised that D is an option, isn’t that overkill?

Ora 12 months ago

I think B is a bad idea, UDP isn’t reliable.

Milly 12 months ago

Definitely A and C for better reliability!

Annett 1 year ago

I feel like using syslog servers with a Universal Forwarder makes sense for data persistence, but I need to double-check that.

Sharmaine 1 year ago

I’m a bit confused about the UDP inputs; I thought they were less reliable than TCP.

Hyun 1 year ago

I remember practicing a question like this, and I think using a network load balancer could help with traffic management.

Clorinda 1 year ago

I think using TCP syslog is definitely a good choice for reliability, but I'm not sure about the others.

Long 1 year ago

This question seems a bit tricky, but I think I can figure it out. Let me think through the options carefully.

Sharen 1 year ago

I'm pretty confident the answer is C, HMaster. That's not a core component of the HBase data write process as far as I know.

Domonique 1 year ago

This question seems straightforward. I think the answer is Workspace ONE UEM, since it provides a unified platform for managing and securing endpoints.

Virgina 1 year ago

Okay, I've got this. The key here is to identify the most critical information the auditor needs to review the decision to change the legacy system. That's clearly the current business capabilities - the auditor needs to understand what the system is doing now before they can evaluate the proposed changes. The other options are more technical details that may be important, but not as fundamental.

Splunk SPLK-2002 Exam - Topic 15 Question 54 Discussion