The universal forwarder has which capabilities when sending data? (Choose all that apply.)
The universal forwarder has which capabilities when sending data? (Choose all that apply.)
The universal forwarder has the capability to compress data before sending it. This helps in reducing the bandwidth usage while transmitting data to the receiving indexers. Additionally, the universal forwarder supports indexer acknowledgement, which ensures that the receipt of data has been confirmed by the indexer, thereby guaranteeing data integrity and completeness in the indexing process.
D AND B Compressing data is the answer.
I agree
B and D both: compressed=true This tells the forwarder to compress the data before it forwards the data to receiving indexers in the target groups. If you set compressed to "false", the forwarder sends raw data. Splunk doc: https://docs.splunk.com/Documentation/Forwarder/8.1.1/Forwarder/Configureforwardingwithoutputs.conf#:~:text=compressed%3Dtrue%20This%20tells%20the,the%20forwarder%20sends%20raw%20data.
B. Compressing data D. Indexer acknowledgement System Admin course, page 182
UF has the following capabilities: - Index ack* (useACK=true in outputs.conf) - Send data over HTTP - Compressing the feed (compressed = true on both input.conf (indexer) and outputs.conf (uf)) - Securing the feed with SSL So, D and B C. that would be a HF A. not sure if Forwarders in general can send alerts
But definetely (a) the UF can't send alerts
Ans is B&D
B AND D !!!
B and D are correct
The capabilities of a universal forwarder when sending data include: B. Compressing data D. Indexer acknowledgement Explanation: - **Compressing data**: Universal forwarders can compress data before sending it to reduce bandwidth usage. - **Indexer acknowledgement**: They can confirm receipt of data by the indexer to ensure data integrity and completeness in the indexing process. < https://bitly.cx/NyKD > I passed my SPLK exam with ease thanks to you. The dumps were accurate and the explanations were clear.
B and D is correct . C(masking) can be done with the Heavy Forwarder not the Universal. Universal only parses data.
B and D are correct
I think C is also correct. https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata "To anonymize data with Splunk Enterprise, you must configure a Splunk Enterprise instance as a heavy forwarder and anonymize the incoming data with that instance before sending it to Splunk Enterprise."
In this case they are referring to "universal forwarder" not a heavy, so "C" is out.
B & D are the answers
Answer is B
Data Admin - Slide 65