Objective 13.1

Enterprise Certified Architect

Forwarding issues

Objective 13.1 sits in Deployment Problems, which carries 5% of the Enterprise Certified Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.

Objective title verbatim from the official objectives. Splunk exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

13-1Deployment Problems

An engineer asks what a forwarder does with data it reads. What does Splunk say?

Searches it locallyA universal forwarder cannot search data.
Indexes it locallyA universal forwarder cannot index data.
Forwards it onwardCorrect · your answerCorrect.
Archives it locallyArchiving happens after data is indexed.

Correct.

Checked against help.splunk.com, August 2026

Concept

The forwarder's job ends at delivery, which is what keeps it small. Anything that happens to the data afterwards is the receiver's concern.

Why C

Splunk states that you can forward data from one Splunk Enterprise instance to another or to a non-Splunk system, and that the instance performing the forwarding is called a forwarder.

Source

The universal forwarder can get data from a variety of inputs and forward the data to a Splunk deployment for indexing and searching. It can also forward data to another forwarder as an intermediate step before sending the data onward to an indexer.

Splunk Docs: Types of forwarders, checked August 2026
#forwarders#troubleshooting

Now you: objective 13.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

13-1Deployment Problems

A forwarding problem appears only after an upgrade. What does Splunk say to consider?

Sample question 2 of 3

13-1Deployment Problems

An administrator asks where the universal forwarder can send data. Which does Splunk name?

Sample question 3 of 3

13-1Deployment Problems

A team plans scripts on a universal forwarder and they fail. What does Splunk say it lacks?

Full Enterprise Certified Architect question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Deployment Problems