How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)
How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)
To enable indexer acknowledgement for HTTP Event Collector (HEC), it is necessary to either set the property for indexer acknowledgement to 1 when a REST request is sent to create a token, or to select the checkbox labeled 'Enable indexer acknowledgement' when creating a new HEC token in Splunk Web. These actions are required to ensure that indexer acknowledgement is properly configured.
Answer is C. Global settings n Splunk web don't have such option, so D is wrong
Correct
The correct answer is BC. B. When a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1. C. When a new HEC token is created in Splunk Web, select the checkbox labeled “Enable indexer acknowledgement”.
it is BC "Can be enabled/disabled using Splunk Web or by sending a REST request"
Guess answer is C and D https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/AboutHECIDXAck
BC is the way
Its CD. A - It is only default if set as in option D. B - When indexer acknowledgement is on you pass a guid in the header, but to turn on you must set in the token, not in the request.