Splunk Enterprise Certified Admin Practice Test

Which item can NOT be included in a deployment app?

1. A bundle of arbitrary content

2. A full Splunk Enterprise app

3. Scripts and supporting files

4. Heavy forwarders to distribute

The correct answer is: Heavy forwarders to distribute

In a deployment app within Splunk, you typically encapsulate configurations, scripts, and other supporting files that are necessary to manage and distribute settings across multiple Splunk instances. However, a deployment app cannot include heavy forwarders meant to distribute data. Heavy forwarders are standalone components designed to perform data ingestion and processing tasks, which should be managed separately from deployment apps. When discussing deployment apps, it is essential to recognize that they serve as a means to distribute configurations without containing the actual components like heavy forwarders, which handle more complex data routing and processing duties. A deployment app is primarily focused on ensuring proper configuration and settings are applied across different Splunk instances rather than distributing the actual software components required for data handling. Thus, the role of a deployment app is limited to configurations and scripts intended for configuration management, while heavy forwarders are part of a different ecosystem within Splunk's architecture.