Splunk Enterprise Certified Admin Practice Test

How frequently does a forwarder send its logs to the monitoring console?

1. Every 5 minutes

2. Every 10 minutes

3. Every 15 minutes

4. Every 30 minutes

The correct answer is: Every 15 minutes

In Splunk, the frequency at which a forwarder sends logs to a monitoring console is determined by the default configuration settings of the forwarder. By default, a Splunk forwarder sends its log data to the designated indexer or monitoring console every 15 minutes. This default behavior is designed to balance the timely delivery of log data with the network load that could be created by more frequent transmissions. While it is possible to modify this setting based on specific organizational needs or configurations, the default interval of 15 minutes serves as a standard practice. This allows for efficient data management and ensures that the logs are sent regularly without overwhelming the network resources or the receiving systems. In the context of the different frequency choices provided, the correct option highlights the default behavior of Splunk forwarders in relation to log transmission. Other options represent intervals that are not aligned with the standard configuration, making them less accurate in this context.