How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)

Indexer acknowledgement for the HTTP Event Collector (HEC) is a setting configured on a per-token basis to ensure data durability. It is not enabled by default. It can be enabled through two primary methods:

1. Via the Splunk Web user interface, by selecting the "Enable indexer acknowledgement" checkbox during the creation of a new HEC token.

2. Programmatically via the REST API, by setting the useACK parameter to 1 (or true) in the POST request to the services/data/inputs/http endpoint when creating a new token. This allows for automated and scripted configuration of HEC tokens with guaranteed delivery enabled.

A. Indexer acknowledgement is disabled by default for HEC tokens to optimize for performance over guaranteed delivery. It must be explicitly enabled.

D. Indexer acknowledgement is a per-token setting, not a global one. Global HEC settings manage aspects like the port number and SSL, but not data delivery guarantees for individual tokens.

1. Splunk Enterprise Documentation

Getting Data In Manual

"Use indexer acknowledgment": This document explicitly states

"Indexer acknowledgment is not enabled by default for HEC tokens." It then provides instructions for enabling it via Splunk Web: "On the Select Source page

select the Enable indexer acknowledgment checkbox." (Reference: Splunk Enterprise 9.x Documentation

Getting Data In

Chapter: "Set up and use HTTP Event Collector in Splunk Web"

Section: "Enable indexer acknowledgment for an HEC token").

2. Splunk Enterprise Documentation

REST API Reference Manual

"data/inputs/http/{name}": The documentation for the POST method on the services/data/inputs/http/{name} endpoint lists the available parameters for creating an HEC token. It includes the useACK parameter

described as: "Set to true to enable indexer acknowledgement." The API accepts boolean true/false or integer 1/0 values. (Reference: Splunk Enterprise 9.x Documentation

REST API Reference Manual

Endpoints: data/inputs/http/{name}

Method: POST).