https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/AboutHECIDXAck
Sending events to HEC with indexer acknowledgment active is similar to sending them with the setting off. There is one crucial difference: when you have indexer acknowledgment turned on, you must specify a channel when you send events.
The concept of a channel was introduced in HEC primarily to prevent a fast client from impeding the performance of a slow client. When you assign one channel per client, because channels are treated equally on Splunk Enterprise, one client can't affect another.
You must include a matching channel identifier both when sending data to HEC in an HTTP request and when requesting acknowledgment that events contained in the request have been indexed. If you don't, you will receive the error message, "Data channel is missing." Each request that includes a token for which indexer acknowledgment has been enabled must include a channel identifier, as shown in the following example cURL statement, where <data> represents the event data portion of the request:
B should be right answer. While HEC has precautions in place to prevent data loss, it’s impossible to completely prevent such an occurrence, especially in event of NW failure or HW crash.
https://docs.splunk.com/Documentation/Splunk/9.1.0/Data/AboutHECIDXAck
Answer is A
https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/AboutHECIDXAck#:~:text=when%20you%20have%20indexer%20acknowledgment%20turned%20on%2C%20you%20must%20specify%20a%20channel%20when%20you%20send%20events.
Confirmed it is A
https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/AboutHECIDXAck - Section: About channels and sending data
upvoted 3 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
kiranhar
Highly Voted 3 years, 1 month agonot_another_user_007
3 years agojbr21
Most Recent 4 days, 7 hours agoallahsal
7 months agoyaman778
1 year, 1 month agoSeba0297
2 years, 4 months agofuriousjase
3 years ago