After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?
After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?
The correct index to check for confirming a successful connection between a universal forwarder and an indexer in Splunk is index=_internal. This index contains logs and internal data for Splunk which helps in troubleshooting and validating the connection.
correct answer is D
D is correct
D. index=_internal host=<forwarder_hostname>, page 183, System Admin PDF