Splunk Enterprise Certified Admin Practice Test

How would you configure Selective Routing on a Universal Forwarder?

1. By editing inputs.conf

2. By creating a new forwarder

3. Through a web interface

4. By modifying outputs.conf only

The correct answer is: By editing inputs.conf

To configure Selective Routing on a Universal Forwarder, editing the inputs.conf file is the correct approach because this file allows you to define parameters for data inputs and specifies which data should be sent and how it should be processed before forwarding. In this context, inputs.conf is crucial for setting up the criteria that determines the selective routing of events based on specific source types, hostnames, or other attributes. While other options may seem relevant, they either do not directly apply or are incomplete. Creating a new forwarder does not directly relate to the selective routing configuration; it's more about deploying another instance of a forwarder. A web interface is not typically used for configuring Universal Forwarders, as most configurations are done through text files in Splunk. Modifying outputs.conf alone would focus on how data is sent out, but without the input definitions set in inputs.conf, the selective criteria for routing would not be established. Therefore, the most effective method for configuring this functionality is indeed through the inputs.conf file.