MENU
A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?
Suggested Answer: C
Get Premium SPLK-2002 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
IS
Isaac
11 months ago
Really? I thought using a forwarder was outdated.
NA
Na
11 months ago
I agree, C is the best practice for sure!
GI
Giuseppe
12 months ago
Wait, isn't it better to send directly to indexers?
SA
Salena
12 months ago
I think option D could work too, but C is more efficient.
KA
Kayleigh
12 months ago
Definitely go with option C, that's the standard way!
HA
Hayley
1 year ago
I vaguely recall that using a Splunk indexer directly for syslog might not be ideal, but I can't remember the exact reasons why.
DO
Dortha
1 year ago
I feel like configuring syslog to send data to multiple indexers could be a good option, but I’m not confident if that’s the most efficient way to handle it.
IZ
Izetta
1 year ago
I remember a practice question where we had to decide between using a forwarder or direct ingestion, and I think the forwarder was preferred for better scalability.
ME
Melvin
1 year ago
I think using a Splunk forwarder to collect the input on port 514 makes sense, but I'm not entirely sure if that's the best practice.
EL
Eloisa
1 year ago
I'm pretty sure Six Sigma is a quality management approach, but I can't remember all the details. I'll need to think through the options carefully.
HA
Hana
1 year ago
Hmm, I'm a bit unsure about this one. I know it's related to controls, but I'm not sure which of these options is the most direct factor. I'll have to think it through.
FR
Freeman
1 year ago
I'm a bit confused by this question. I'm not sure if I should be focusing on the model, the training endpoint, the authentication key, or the REST endpoint. Can someone clarify which two parameters are the correct ones to use?