Splunk Enterprise Certified Admin Practice Test

What indicates a successful connection from the indexer to the forwarder in the CLI?

1. Fetching logs from forwarder

2. No error messages present

3. Displaying active forwarders

4. Success message from CLI command

The correct answer is: Displaying active forwarders

The indication of a successful connection from the indexer to the forwarder in the Command Line Interface (CLI) is reflected in displaying active forwarders. When you execute a relevant CLI command, the output lists all currently connected forwarders. This output demonstrates that the indexer is successfully receiving data from the forwarder, confirming that a connection has been established. While fetching logs from the forwarder could suggest that the data transfer is taking place, it does not directly indicate the status of the connection itself. Additionally, the absence of error messages is helpful, but it does not confirm an active connection. A success message from a command may also indicate a properly configured connection, yet displaying active forwarders provides a clearer, real-time confirmation of ongoing connections to the indexer.