Splunk Enterprise Certified Admin Practice Test

Which input type is suitable for polling a database or API in Splunk?

1. Network input

2. Universal forwarder

3. Scripted input

4. Heavy forwarder

The correct answer is: Scripted input

The correct choice is suitable for polling a database or API because it allows for custom scripts to be executed, which can then retrieve data from external sources such as databases or APIs. Scripted inputs are flexible, enabling users to write scripts in various programming languages that can take parameters and perform complex operations, such as querying a database or making API calls to gather the necessary data. This approach is particularly advantageous when dealing with data sources that do not have a native Splunk input. By using a scripted input, administrators can define how and when the data is collected, allowing for tailored data polling intervals, error handling, and data transformation before it is sent to Splunk for indexing. Moreover, the output of these scripts can be easily formatted to fit the expected data input types in Splunk. Other options, while they may serve different purposes, do not provide the necessary flexibility for direct interaction with databases or APIs required for polling. For instance, network inputs are designed for capturing data from network sources, universal forwarders primarily facilitate the forwarding of log files, and heavy forwarders handle data routing and parsing but are not focused specifically on custom polling.