Several on-premises Linux servers write application and audit logs to local files. The Splunk team wants those files collected continuously, with the collector tracking how far it has read and holding data when the indexers are briefly unreachable, so no lines are lost. What should be deployed?
Select an answer to reveal the explanation.
Short Explanation
When the data lives in files on your own servers, send a courier who lives there too. The universal forwarder tails the files, remembers where it stopped, and queues data if the indexers blink. HEC is great for apps that push, but the trap here is rewriting every app when the logs are already on disk.
Full Explanation
The Splunk universal forwarder is a lightweight agent designed to collect data from files and other local sources and send it to indexers. A monitor input tails each log file, records its read position so it resumes where it left off after restarts or rotations, and buffers data in queues when the indexers are temporarily unreachable; indexer acknowledgment can be enabled so the forwarder resends data the indexer has not confirmed. That behavior directly satisfies the requirement for continuous, lossless collection from on-premises files. HTTP Event Collector suits applications and services that can push events over HTTP, but here the logs already exist as files, and rewriting every application to post lines is unnecessary effort that adds failure modes. A lookup reads reference data to enrich searches; it does not ingest or index log files, and reading over NFS at search time provides neither persistence nor history. Data model acceleration summarizes data that is already indexed for faster searches; it cannot collect anything. Exam caveat: forwarders and HEC are both valid ingestion methods; choose based on whether the source writes files or pushes events. Operational check: deploy the forwarder with the monitor stanzas, confirm it appears as connected in the monitoring console, and search the target index for recent events from each host.