How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)
How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)
To enable indexer acknowledgement for HTTP Event Collector (HEC), it is necessary to either set the property for indexer acknowledgement to 1 when a REST request is sent to create a token, or to select the checkbox labeled 'Enable indexer acknowledgement' when creating a new HEC token in Splunk Web. These actions are required to ensure that indexer acknowledgement is properly configured.
Answer is C. Global settings n Splunk web don't have such option, so D is wrong
Correct
Guess answer is C and D https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/AboutHECIDXAck
it is BC "Can be enabled/disabled using Splunk Web or by sending a REST request"
The correct answer is BC. B. When a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1. C. When a new HEC token is created in Splunk Web, select the checkbox labeled “Enable indexer acknowledgement”.
Its CD. A - It is only default if set as in option D. B - When indexer acknowledgement is on you pass a guid in the header, but to turn on you must set in the token, not in the request.
BC is the way