As a best practice, the following should be used to ingest data on clustered indexers: splunktcp, splunktcp-ssl, HTTP Event Collector (HEC). These are the methods that allow data to be sent to the indexers by forwarders or other data sources, without requiring any configuration on the indexers themselves. The indexers can receive the data on specific ports and index it according to the cluster settings. These methods also support load balancing and encryption of the data. Therefore, the correct answer is D. splunktcp, splunktcp-ssl, HTTP Event Collector (HEC). References:
Splunk Core Certified Consultant Test Blueprint
Splunk Documentation: Forward data to an indexer cluster
Splunk Documentation: About forwarding and receiving data
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit