SPLK-2001 Exam Dumps : Splunk Certified Developer Exam

 The correct answer is B, C, and D because these are the ways to enable indexer acknowledgement for HTTP Event Collector (HEC). Indexer acknowledgement is a feature that ensures that the data sent to HEC is successfully indexed by Splunk before deleting it from the sender. Option B is correct because you can use a REST request to create a token with the indexer_ack property set to 1. Option C is correct because you can select the checkbox labeled “Enable indexer acknowledgment” when creating a new HEC token in Splunk Web. Option D is correct because you can select the checkbox labeled “Enable indexer acknowledgment” when updating the Global Settings for HEC in Splunk Web. Option A is incorrect because indexer acknowledgment is not turned on by default. You can find more information about indexer acknowledgment for HEC in the Splunk Developer Guide.

When the same search is required from a REST API call, all the fields will be given, including _raw, name, sourcetype, and instantaneous_kbps. This is because the default output mode for the REST API is XML, which returns all the fields and values for each event. To limit the fields returned, you can use the output_mode parameter with a value of json_cols, json_rows, or csv. For more information, see Access Splunk data using feeds.

The log file that contains logs that are most relevant to Splunk Web is web_service.log. This log file records information about the web server that runs Splunk Web, such as requests, responses, errors, and performance. The other log files contain logs that are related to other aspects of Splunk, such as audit.log for security events, metrics.log for performance metrics, and splunkd.log for Splunk daemon activity. For more information, see [About Splunk log files].