Free Preparation Discussions
MENU
Splunk SPLK-5002 Exam - Topic 1 Question 4 Discussion
Topic #: 1
An engineer observes a delay in data being indexed from a remote location. The universal forwarder is configured correctly.
What should they check next?
If there is a delay in data being indexed from a remote location, even though the Universal Forwarder (UF) is correctly configured, the issue is likely a queue blockage or network latency.
Steps to Diagnose and Fix Forwarder Delays:
Check Forwarder Logs (splunkd.log) for Queue Issues (A)
Look for messages like TcpOutAutoLoadBalanced or Queue is full.
If queues are full, events are stuck at the forwarder and not reaching the indexer.
Monitor Forwarder Health Using metrics.log
Use index=_internal source=*metrics.log* group=queue to check queue performance.
Incorrect Answers: B. Increase the indexer memory allocation -- Memory allocation does not resolve forwarder delays. C. Optimize search head clustering -- Search heads manage search performance, not forwarder ingestion. D. Reconfigure the props.conf file -- props.conf affects event processing, not ingestion speed.
Splunk Forwarder Troubleshooting Guide
Monitoring Forwarder Queue Performance
Alline
2 months agoDevora
2 months agoTerina
2 months agoWilletta
3 months agoPamella
3 months agoAlona
3 months agoMicah
3 months agoMari
4 months agoLeandro
4 months agoMitzie
4 months agoIsadora
4 months agoBenton
4 months agoAlana
5 months agoSocorro
5 months agoMakeda
10 months agoRoselle
10 months agoKallie
10 months agoTamesha
11 months agoVernell
8 months agoGerman
9 months agoDorcas
9 months agoFlo
9 months agoBarrett
9 months agoJanet
9 months agoRashida
9 months agoNoble
9 months agoAn
9 months agoPaz
9 months agoLorrine
9 months agoAnnelle
11 months agoDeonna
11 months agoPortia
11 months agoKarma
11 months agoAn
10 months agoJame
10 months agoCheryll
10 months agoBillye
11 months agoElise
11 months agoJunita
11 months ago