https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/AboutHECIDXAck
Sending events to HEC with indexer acknowledgment active is similar to sending them with the setting off. There is one crucial difference: when you have indexer acknowledgment turned on, you must specify a channel when you send events.
The concept of a channel was introduced in HEC primarily to prevent a fast client from impeding the performance of a slow client. When you assign one channel per client, because channels are treated equally on Splunk Enterprise, one client can't affect another.
You must include a matching channel identifier both when sending data to HEC in an HTTP request and when requesting acknowledgment that events contained in the request have been indexed. If you don't, you will receive the error message, "Data channel is missing." Each request that includes a token for which indexer acknowledgment has been enabled must include a channel identifier, as shown in the following example cURL statement, where <data> represents the event data portion of the request:
A
when you have indexer acknowledgment turned on, you must specify a channel when you send events
https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/AboutHECIDXAck#:~:text=when%20you%20have%20indexer%20acknowledgment%20turned%20on%2C%20you%20must%20specify%20a%20channel%20when%20you%20send%20events.
indexer acknowledgment in HEC is not the same as the indexer acknowledgment capability for forwarding.
B should be right answer. While HEC has precautions in place to prevent data loss, it’s impossible to completely prevent such an occurrence, especially in event of NW failure or HW crash.
https://docs.splunk.com/Documentation/Splunk/9.1.0/Data/AboutHECIDXAck
Answer is A
https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/AboutHECIDXAck#:~:text=when%20you%20have%20indexer%20acknowledgment%20turned%20on%2C%20you%20must%20specify%20a%20channel%20when%20you%20send%20events.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
kiranhar
Highly Voted 3 years, 2 months agonot_another_user_007
3 years, 1 month agoBetoemihtevas
Most Recent 2 weeks, 6 days agojbr21
1 month agoallahsal
8 months agoyaman778
1 year, 2 months agoSeba0297
2 years, 5 months agofuriousjase
3 years, 1 month ago