SPLK-1003 Exam Dumps : Splunk Enterprise Certified Admin

This is because the input type is UDP, which is an unreliable protocol that does not guarantee delivery, order, or integrity of the data packets. UDP does not have any mechanism to resend or acknowledge the data packets, so if Splunk is restarted, any data that was in transit or in the buffer may be dropped and not indexed.

In Splunk Enterprise and Splunk Universal Forwarder, data inputs are configured using stanzas in inputs.conf. Each stanza defines a listener for a particular input type (for example, TCP or UDP) and a specific port.

Splunk documentation states that a single TCP input stanza can receive data from multiple remote hosts sending to the same TCP port, and similarly, a single UDP input stanza can receive data from multiple devices sending to the same UDP port. Therefore, the number of sending devices does not determine the number of stanzas required; rather, the input protocol and port type do.

In this case:

All three TCP devices can send data to one TCP port (one stanza).

All four UDP devices can send data to one UDP port (one stanza).

Thus, the minimum number of input stanzas required is two — one for TCP and one for UDP.

Example configuration (inputs.conf):

# TCP input for three switches sending via TCP

[tcp://9997]

sourcetype = switch_logs

# UDP input for four switches sending via UDP

[udp://514]

sourcetype = switch_logs

This configuration ensures all seven devices’ logs are collected without creating individual stanzas for each device.

Reference (Splunk Documentation):

Splunk® Enterprise Admin Manual → Configure Data Inputs → “Listen for network data”

inputs.conf.spec and example → “You can configure a single TCP or UDP input to receive data from multiple remote hosts.”

Splunk Universal Forwarder Manual → Configure Forwarding Inputs → “Universal Forwarders can listen on a single TCP or UDP port for multiple remote data sources.”