Splunk Enterprise Certified Admin Practice Test

What needs to be done to add inputs on forwarders?

1. Configure in server.conf

2. Modify outputs.conf

3. Use forwarder management or CLI

4. Set up data sources in Splunk Web

The correct answer is: Use forwarder management or CLI

To add inputs on forwarders, utilizing forwarder management or the command line interface (CLI) is the correct approach. This method allows admins to effectively manage the data that is being forwarded to the Splunk indexers by configuring inputs directly on the forwarder. By using forwarder management, administrators can streamline the process of configuring multiple forwarders from a centralized location, ensuring consistent configurations across all devices. The CLI also provides direct access to configure inputs, giving full control over the setup process. In contrast, configuring server.conf is not typically where input data sources are defined; this file is more focused on the overall server settings. Modifying outputs.conf deals with the forwarder's connection settings to the indexer rather than its data inputs. Setting up data sources in Splunk Web generally pertains to the indexers or the Splunk Enterprise search heads rather than the forwarders themselves. Therefore, relying on forwarder management or the CLI is the efficient way to manage data inputs on forwarders.