Question 4
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining thattheeventsareinconsistently formattedfora websourcetype. Further investigation revealsthatnotallweblogsflowthroughthe sameinfrastructure:some ofthedatagoesthrough heavy forwarders and some of the forwarders are managed by another department.
Which of the following items might be the cause for this issue?
Thesearch headmayhavedifferentconfigurationsthantheindexers.
Thedatainputs are notproperlyconfigured across all theforwarders.
The indexers may have different configurations than the heavy forwarders.
The forwarders managed by the other department are an older version than the rest.
Correct answer: D