After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?
A) index=main
B) index=test
C) index=summary
D) index=_internal

Question

Quizplus · Accepted Answer

The index=_internal is used to store Splunk's internal logs, including logs from forwarders, which can be checked to verify successful communication between a universal forwarder and an indexer.

After Configuring a Universal Forwarder to Communicate with an Indexer