Per the provided Splunk reference URLhttps://docs.splunk.com/Documentation/Splunk/8.0.5/Data/AboutHECIDXAck
"While HEC has precautions in place to prevent data loss, it's impossible to completely prevent such an occurrence, especially in the event of a network failure or hardware crash. This is where indexer acknolwedgment comes in."
The correct answer is A. This has to be enabled at the token level in Splunk Web. If you want to enable it via the configuration files, you would add a stanza with the corresponding token and add the line useACK=true.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
shivi
Highly Voted 3 years agoucsdmiami2020
2 years, 5 months agoFrozenYeti
Most Recent 4 weeks, 1 day agoadamsca
7 months, 1 week agomngesha
1 year agorockhorse
1 year, 8 months ago