Examice

Exam SPLK-1003 All QuestionsBrowse all questions from this exam

Go to Exam

Question 32

Which of the following enables compression for universal forwarders in outputs.conf?

[udpout:mysplunk_indexer11] compression=true

[tcpout] defaultGroup=my_indexers compressed=true

/opt/splunkforwarder/bin/splunk enable compression

[tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false

Correct Answer: B

To enable compression for universal forwarders in the outputs.conf file, you need to add the 'compressed=true' option in the [tcpout] stanza. This specifies that the forwarder should compress data before sending it to the indexers. The correct configuration that matches this requirement is '[tcpout] defaultGroup=my_indexers compressed=true'.

Discussion

amporiikOption: B

B. [tcpout] defaultGroup=my_indexers compressed=true to enable compression on UF add option compressed=true in stanza

ectomorphOption: B

this answer = B - formatting is wonky... You could also see for SSL (shown below) [tcpout] defaultGroup=my_indexers compressed=true #HTTP Only useClientSSLCompression=true #SSL

loky0Option: B

B. P73 data admin pdf

ucsdmiami2020

Agreed B. Quoting the reference URL https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf # Compression # # This example sends compressed events to the remote indexer. # NOTE: Compression can be enabled TCP or SSL outputs only. # The receiver input port should also have compression enabled. [tcpout] server = splunkServer.example.com:4433 compressed = true

ApisOption: B

B is correct

gsplunkerOption: B

B is the ans