Discuss Splunk SPLK-3003 Exam Topic 3 Question 16

A customer has a network device that transmits logs directly with UDP or TCP over SSL. Using PS best practices, which ingestion method should be used?

AOpen a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing tier.

BOpen a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.

CUse a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit the data to the indexing tier.

DUse a syslog server to aggregate the data to files and use a universal forwarder to read and transmit the data to the indexing tier.

Suggested Answer: D

Get Premium SPLK-3003 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Lili 11 months ago

Wait, can you really use UDP with SSL? That sounds sketchy!

Sharmaine 11 months ago

D sounds interesting, but is it really the best option?

Elly 12 months ago

C seems outdated, why not just use a heavy forwarder?

Buffy 12 months ago

I think B could work too, but not as secure.

Kate 12 months ago

Definitely A, SSL over TCP is the way to go!

Micaela 1 year ago

I’m leaning towards option C because it talks about using a syslog server, but I’m not confident about whether that’s the best practice for SSL logs.

Dorethea 1 year ago

I'm not entirely sure, but I remember something about UDP being less reliable. Maybe option B isn't the best choice?

Brandon 1 year ago

I think we should go with option A since it mentions using TCP with SSL, which seems more secure for log transmission.

Brandon 1 year ago

I feel like we've seen a similar question before, and I think using a heavy forwarder is usually the right move. So, option A sounds good to me.

Levi 1 year ago

This looks like a straightforward question about defining testable acceptance criteria. I'll focus on identifying the criteria that can be objectively verified.

Gail 1 year ago

I'm pretty sure the answer is A. The question specifically mentions "did_url_mappings/2.0", and the file "GVPOwner_Admin_.xml" seems like it would be an example of a file installed in that directory.

King 1 year ago

I'm a bit confused—wasn't there some discussion about SOAP vs. REST? I feel like HTTP is the answer, but not 100% confident.

Splunk SPLK-3003 Exam - Topic 3 Question 16 Discussion