What action is required to enable forwarder management in Splunk Web?
C
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.2.1/Updating/Forwardermanagementoverview
https://docs.splunk.com/Documentation/MSApp/2.0.3/MSInfra/Setupadeploymentserver
"To activate deployment server, you must place at least one app into
%SPLUNK_HOME%\etc\deployment-apps on the host you want to act as deployment server. In this
case, the app is the "send to indexer" app you created earlier, and the host is the indexer you set up
initially.
To enable forwarder management in Splunk Web, the deployment server must have at least one app in the SPLUNK_HOME/etc/deployment-apps directory. Once an app is placed in this directory, the forwarder management feature is automatically enabled in the Splunk Web interface. This allows you to manage forwarders through server classes.
Why the other options are incorrect:
A. Navigate to Settings > Server Settings > General Settings, and set an App server port: This setting configures the general Splunk server port but does not enable forwarder management.
B. Navigate to Settings > Forwarding and receiving, and click on Enable Forwarding: This setting configures data forwarding, not forwarder management.
C. Create a server class and map it to a client in SPLUNK_HOME/etc/system/local/serverclass.conf: While server classes are part of forwarder management, creating them does not directly enable the feature in Splunk Web.