Cribl Source & Destination Configuration 2

Question 1

What is the default port for the Cribl HTTP Source when configured in Splunk HEC compatibility mode?

Accepted Answer

8088

Answer

Cribl's HTTP Source defaults to port 8088 to match Splunk's HTTP Event Collector (HEC) default port.

Question 2

Which source type should be configured in Cribl to receive data from Splunk Universal Forwarders?

Accepted Answer

Splunk TCP Source

Answer

The Splunk TCP Source handles the proprietary Splunk forwarder protocol used by Universal Forwarders.

Question 3

When setting up a Kafka source in Cribl, which configuration element is required to identify which data stream to consume?

Accepted Answer

Topic name

Answer

The topic name is required to tell Cribl which Kafka topic to consume from, along with the broker address.

Question 4

What is the function of an authentication token configured on an HTTP source in Cribl?

Accepted Answer

Validate and authorize incoming requests

Answer

The authentication token on an HTTP source validates that incoming requests are authorized, rejecting unauthenticated clients.

Question 5

Which Cribl destination type should you choose to forward processed events directly to a Splunk indexer cluster?

Accepted Answer

Splunk

Answer

The Splunk destination uses the Splunk forwarder protocol to send events directly to Splunk indexers.

(Cribl) Cribl Observability Pipeline Certification Practice Test