Exam SPLK-2002 topic 1 question 68 discussion

My Answer is BCD

B. Splunk can search data in the Hadoop File System (HDFS). C. You can use Splunk alerts to provision actions on a third-party system. D. You can forward data from Splunk forwarder to a third-party system without indexing it first.

Unpopular answer I guess, but I'd say A and C. A. Hadoop applications can search data in Splunk using the REST API at minimum C. Alert actions can be used to trigger actions based on a query result But not... B. Splunk can't search data on HDFS without indexing it first. D. I see other comments saying that there's a 3rd party tool that can receive data directly from a UF, but assume that this is talking about first-party architecture as designed (and, besides, they have a lawsuit open against Cribl :))

100% B,C,D B. Splunk can search data in the Hadoop File System (HDFS). - Correct C. You can use Splunk alerts to provision actions on a third-party system. - Correct: Systems such as Critical Start can utilize alerts to provision additional actions from within their system. D. You can forward data from Splunk forwarder to a third-party system without indexing it first. - Correct: As mentioned Cribl LogStream can ingest data directly from the UF modify the streamed data, and then forward that data to the indexer(s)

B,C Not D bc the it can only send data AFTER it's indexed