Question 29 - SPLK-1005 discussion

Configuring a Universal Forwarder (UF) as an Intermediate Forwarder involves making changes to its configuration to allow it to receive data from other forwarders before sending it to indexers.

D . It is only possible to make this change directly in configuration files or via a deployment app: This is the correct answer. Configuring a Universal Forwarder as an Intermediate Forwarder is done by editing the configuration files directly (like outputs.conf), or by deploying a pre-configured app via a deployment server. The Splunk Web UI (Management Console) does not provide an interface for configuring a Universal Forwarder as an Intermediate Forwarder.

A . This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI: Incorrect, as this applies to Heavy Forwarders, not Universal Forwarders.

B . The configuration changes can be made using Splunk Web, CLI, directly in configuration files, or via a deployment app: Incorrect, the Splunk Web UI is not used for configuring Universal Forwarders.

C . The configuration changes can be made using CLI, directly in configuration files, or via a deployment app: While CLI could be used for certain configurations, the specific Intermediate Forwarder setup is typically done via configuration files or deployment apps.

Splunk Documentation

Reference:

Universal Forwarder Configuration

Intermediate Forwarder Configuration