A customer has a Universal Forwarder (UF) with an inputs.confmonitoring its splunkd.log. The data is sent through a heavy forwarder to an indexer. Where does the Index time parsing occur?

A customer has a Universal Forwarder (UF) with an inputs.confmonitoring its splunkd.log. The data is sent through a heavy forwarder to an indexer. Where does the Index time parsing occur?
A . Indexer
B . Universal forwarder
C . Search head
D . Heavy forwarder

View Answer

Answer: D

Explanation:

Reference: https://www.learnsplunk.com/splunk-interview-questions.html