The CLI command splunk add forward-server indexer:
The CLI command splunk add forward-server indexer:
The splunk add forward-server indexer:<receiving-port> command is used to specify a target indexer and its receiving port for data forwarding. This configuration involves outgoing data specifying where the forwarder should send the data. Such settings are typically defined in the outputs.conf file, aligning with its function of managing outbound data configurations to indexers.
The Ans is C The CLI command "Splunk add forward-server indexer:<receiving-port>" is used to define the indexer and the listening port on forwards. The command creates this kind of entry "[tcpout-server://<ip address>:<port>]" in the outputs.conf file.
Refer to the Splunk docs URL for "Configure forwarding with outputs.conf" found in the Forwarder Manual https://docs.splunk.com/Documentation/Forwarder/8.2.2/Forwarder/Configureforwardingwithoutputs.conf Section titled, Examples of outputs.conf supports the answer being C
Friends, C is final. Could you please confirm this answer?
correct answer is C
Ans is C. pg 181 in Sys Admin
This command adds an indexer to the outputs.conf.
This is the exact quote from https://docs.splunk.com/Documentation/Splunk/9.0.3/Forwarding/Deployaforwarder "Set up forwarding You can use the CLI as a quick way to enable forwarding. You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk instance.
Yes, its option C
add forwarder-server is the command to let forwarder know where to send the data so this will be data going out to the indexer. so this will be a stanza on the outputs.conf file
outputs.conf (you're defining target indexers on the forwarder)
I would say its option C Set up forwarding You can use the CLI as a quick way to enable forwarding. You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk instance. Although setting up forwarders with outputs.conf requires a bit more initial knowledge, there are obvious advantages to performing all forwarder configurations in a single location
To configure target indexers on forwarders, either: – Run splunk add forward-server <indexer:receiving_port> – Modify outputs.conf