Splunk Exam SPLK-3003 Topic 10 Question 34 Discussion

Actual exam question for Splunk's SPLK-3003 exam

Question #: 34
Topic #: 10

When monitoring and forwarding events collected from a file containing unstructured textual events, what is the difference in the Splunk2Splunk payload traffic sent between a universal forwarder (UF) and indexer compared to the Splunk2Splunk payload sent between a heavy forwarder (HF) and the indexer layer? (Assume that the file is being monitored locally on the forwarder.)

AThe payload format sent from the UF versus the HF is exactly the same. The payload size is identical because they're both sending 64K chunks.

BThe UF sends a stream of data containing one set of medata fields to represent the entire stream, whereas
the HF sends individual events, each with their own metadata fields attached, resulting in a lager payload.

CThe UF will generally send the payload in the same format, but only when the sourcetype is specified in the inputs.conf and EVENT_BREAKER_ENABLE is set to true.

DThe HF sends a stream of 64K TCP chunks with one set of metadata fields attached to represent the entire stream, whereas the UF sends individual events, each with their own metadata fields attached.

Show Suggested Answer

Suggested Answer: B

by Jesusa at May 05, 2022, 08:17 AM

Limited Time Offer

25%

Off

Get Premium SPLK-3003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!