As a best practice which of the following should be used to ingest data on clustered indexers?

In a distributed Splunk architecture, the best practice is to separate the data collection and data indexing tiers. Clustered indexers are optimized for receiving, parsing, indexing, and servicing search requests. Their primary ingestion role is to listen for data sent from other sources. The standard and most scalable methods for this are receiving forwarded data via splunktcp or splunktcp-ssl from Universal or Heavy Forwarders, and receiving data from applications and services via the HTTP Event Collector (HEC). Placing file monitoring or other direct collection inputs on indexers is an anti-pattern that can create single points of failure and adds unnecessary processing load, undermining the resilience and performance of the cluster.

A. Monitoring files and running modular inputs are data collection tasks that should be performed on forwarders, not directly on clustered indexers.

B. This option incorrectly includes inputs.conf monitor stanza and modular inputs, which are not best practices for data ingestion on the indexer tier.

C. This option incorrectly includes direct file monitoring (monitoring via a process), which is a data collection task best suited for the forwarding tier.

1. Splunk Enterprise Documentation, Forwarding Data Manual, "How forwarding works": This section explicitly describes the architecture where forwarders collect and send data to receivers (indexers). It states, "The forwarder sends data to the receiver, which is a Splunk Enterprise instance, such as an indexer or another forwarder." This supports the use of splunktcp on indexers to receive data.

2. Splunk Enterprise Documentation, Getting Data In Manual, "Set up and use HTTP Event Collector in Splunk Web": This document details HEC as a primary method for sending data directly to indexers. The section "How HEC works" notes that HEC tokens are associated with one or more indexes, and data is typically sent to indexers or a dedicated HEC/data collection node.

3. Splunk Enterprise Documentation, Managing Indexers and Clusters of Indexers Manual, "Indexer cluster architecture": The architectural diagrams and descriptions consistently show forwarders as the source of data for the peer nodes (indexers) in a cluster. The configuration examples for indexers focus on receiving data, not actively collecting it from source files.

4. Splunk Enterprise Documentation, Getting Data In Manual, "Monitor files and directories with inputs.conf": This guide states, "The usual practice is to place this type of input on a forwarder to get data from a remote machine." This confirms that file monitoring is not a best practice for the indexer tier.