Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)
Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)
To add inputs on a forwarder, the supported configuration methods include using the Command Line Interface (CLI) and directly editing the inputs.conf file. The CLI allows you to define and manage inputs through Splunk commands. Editing the inputs.conf file manually provides a more direct and customizable approach to set up and manage data inputs. Other methods like Forwarder Management typically focus on deploying configurations across multiple forwarders rather than directly adding inputs on a single forwarder.
It's A and B. On forwarder management you assigned server classes and apps, but adding a new input would be done by editing the inputs.conf on the DS, not using the Forwarder Management web interface.
This needs more upvotes. The main purpose of the forwarder manager is to create server classes and overview the deployment. If you want to change the inputs, you do it via CLI on the forwarder, or change the settings in the inputs.conf file in the associated app on the DS which then will automatically update the settings on the forwarder after some phone home interval.
This is what the Add Data does on the Web UI, i.e., updates/creates the inputs.conf in the deployable app on the DS. It then automatically deploys/re-deploys the app to the remote forwarder.
Add inputs on forwarders, by either: - Editing inputs.conf manually - Using Deployment Server - Running Splunk commands (CLI)
Agreed A and B. Quoting the Reference URL https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/ HowtoforwarddatatoSplunkEnterprise#Define_inputs_on_the_universal_forwarder_with_configuration_files "You can collect data on the universal forwarder using several methods. Define inputs on the universal forwarder with the CLI. You can use the CLI to define inputs on the universal forwarder. After you define the inputs, the universal forwarder collects data based on those definitions as long as it has access to the data that you want to monitor. Define inputs on the universal forwarder with configuration files. If the input you want to configure does not have a CLI argument for it, you can configure inputs with configuration files. Create an inputs.conf file in the directory, $SPLUNK_HOME/etc/system/local
My ans is A,B,D
Agreed. CLI, inputs.conf editing, and via Deployment Server (forwarder maangement). Source: "Configure the universal forwarder to send data to Splunk Enterprise " section at https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/HowtoforwarddatatoSplunkEnterprise
A,B and D, you cna see the below notes in data admin pdf Add inputs on forwarders, by either: - Editing inputs.conf manually - Using Deployment Server - Running Splunk commands (CLI)
Wrong. D is not part of the answer.
The questions says add inputs on a Forwarder - We can add inputs via the CLI ./splunk add monitor We can add inputs editing the inputs.conf and also we can push the inputs.conf via the deployment server So for me A, B , D
A,B and D, check data admin slide 53
A, B, and D - Check page 175 of the SA PDF and you'll see it says: -Forwarder management -CLI -Edit inputs.conf manually
A, B & D
I think it's A, B and D. That's what Forwarder Management is for - to set up the inputs.conf file on the Deployment Server to push out to your Forwarders. Forwarder Management lets you set the apps (what this question is talking about), set the clients, and define the server classes that connect them together
You can add data inputs with: apps and add-ons, splunk web, CLI, editing inputs.conf
agreed for AB
Hi , I'm stuck between a,b or a,b,d but the answer is a,b,d
Forwarder Management is no right, answer is A and B. This is because we can add a forward via Deployment Manager but it is no the same that the Forwarder Manager that is used to create server classes and send apps.
answer is A & D...page 46 Data Admin
Oops! I meant A B D. (correction)
Please can you share the pdf file with me? Thank you!
I would say options AB and D === Add inputs on forwarders, by either: - Editing inputs.conf manually - Using Deployment Server - Running Splunk commands (CLI) ====
ABD Forwarder Mgmt from a deployment server.
If you already have an input set up for a different forwarder then you can add that same input to a different forwarder using Forwarder Management. My answer is A, B and D
A and B for sure, maybe D as well, however D is not configured **on a forwarder**
The correct answer is A & B. Please see the reference for clarification - https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/HowtoforwarddatatoSplunkEnterprise