FirstTry

Objective 14.2

Enterprise Certified Admin

Describe HTTP Event Collector

Objective 14.2 sits in Agentless Inputs, which carries 5% of the Enterprise Certified Admin exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.

Objective title verbatim from the official objectives. Splunk exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

14-2Agentless Inputs

A developer needs her application to reach your Splunk deployment directly, with nothing extra installed on the application server. What does the HTTP Event Collector let applications do?

Replicate buckets to peersBucket replication is handled by an indexer cluster.
Read files from a shareReading files is what a monitor input does.
Query an index directlySearching an index is done through the search interface or the API.
Send events over HTTPCorrect · your answerCorrect.

Correct.

Checked against help.splunk.com, August 2026

Concept

Letting an application post its own events removes the file on disk and the agent that would have read it. The trade is that the application now owns delivery.

Why D

Splunk states that the HTTP Event Collector lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP protocols.

Source

The HTTP Event Collector (HEC) lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols.

Splunk Docs: Set up and use HTTP Event Collector in Splunk Web, checked August 2026
#inputs#hec

Now you: objective 14.2 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 2

14-2Agentless Inputs

You are onboarding an application team to HEC and must hand them a credential to configure in their logging library. Which authentication model does HEC use?

Sample question 2 of 2

14-2Agentless Inputs

Your container images have no room for an agent, so each application posts its events to HEC with a token instead. What does that arrangement remove the need for?

Full Enterprise Certified Admin question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Agentless Inputs