Source & Destination Configuration Flashcards

What is the default port for the Cribl HTTP Source when configured in Splunk HEC compatibility mode?

Answer: 8088

Cribl's HTTP Source defaults to port 8088 to match Splunk's HTTP Event Collector (HEC) default port.

Which source type should be configured in Cribl to receive data from Splunk Universal Forwarders?

Answer: Splunk TCP Source

The Splunk TCP Source handles the proprietary Splunk forwarder protocol used by Universal Forwarders.

When setting up a Kafka source in Cribl, which configuration element is required to identify which data stream to consume?

Answer: Topic name

The topic name is required to tell Cribl which Kafka topic to consume from, along with the broker address.

What is the function of an authentication token configured on an HTTP source in Cribl?

Answer: Validate and authorize incoming requests

The authentication token on an HTTP source validates that incoming requests are authorized, rejecting unauthenticated clients.

Which Cribl destination type should you choose to forward processed events directly to a Splunk indexer cluster?

Answer: Splunk

The Splunk destination uses the Splunk forwarder protocol to send events directly to Splunk indexers.

Which Cribl source type is designed to receive SNMP trap notifications from network devices?

Answer: SNMP Trap Source

Cribl provides a dedicated SNMP Trap Source to receive and parse SNMP trap messages from network equipment.

When configuring a Syslog source in Cribl, which transport protocols are supported for receiving log data?

Answer: TCP and UDP

Cribl's Syslog source supports both TCP and UDP transport protocols for receiving syslog messages.