Which of the following accurately describes HTTP Event Collector indexer acknowledgement?
Which of the following accurately describes HTTP Event Collector indexer acknowledgement?
HTTP Event Collector indexer acknowledgement requires a separate channel provided by the client. When indexer acknowledgement is active, each client must specify a channel when sending events to ensure that the events are properly tracked and acknowledged. This channel identifier is essential to prevent a fast client from affecting the performance of other clients and to ensure that each client’s data is acknowledged independently.
Answer is A
https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/AboutHECIDXAck Sending events to HEC with indexer acknowledgment active is similar to sending them with the setting off. There is one crucial difference: when you have indexer acknowledgment turned on, you must specify a channel when you send events. The concept of a channel was introduced in HEC primarily to prevent a fast client from impeding the performance of a slow client. When you assign one channel per client, because channels are treated equally on Splunk Enterprise, one client can't affect another. You must include a matching channel identifier both when sending data to HEC in an HTTP request and when requesting acknowledgment that events contained in the request have been indexed. If you don't, you will receive the error message, "Data channel is missing." Each request that includes a token for which indexer acknowledgment has been enabled must include a channel identifier, as shown in the following example cURL statement, where <data> represents the event data portion of the request:
Answer is A https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/AboutHECIDXAck#:~:text=when%20you%20have%20indexer%20acknowledgment%20turned%20on%2C%20you%20must%20specify%20a%20channel%20when%20you%20send%20events.
Confirmed it is A https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/AboutHECIDXAck - Section: About channels and sending data
Each client request must provide a channel(a unique identifier created by the client) Data p 172
B should be right answer. While HEC has precautions in place to prevent data loss, it’s impossible to completely prevent such an occurrence, especially in event of NW failure or HW crash. https://docs.splunk.com/Documentation/Splunk/9.1.0/Data/AboutHECIDXAck