SPLK-1005 exam

A user has been asked to mask some sensitive data without tampering with the structure of the file /var/log/purchase/transactions. log that has the following format: A) B) C) D) A . Option AB . Option BC . Option CD . Option DView AnswerAnswer: B Explanation: Option B is the correct...

Which of the following is not a path used by Splunk to execute scripts?A . SPLUNK_HOME/etc/system/binB . SPLUNK HOME/etc/appa/<app name>/binC . SPLUNKHOMS/ctc/scripts/localD . SPLUNK_HOME/bin/scriptsView AnswerAnswer: C Explanation: Splunk executes scripts from specific directories that are structured within its installation paths. These directories typically include: SPLUNK_HOME/etc/system/bin: This directory is used to...

What Splunk command will allow an administrator to view the runtime configuration instructions for a monitored file in Inputs. cont on the forwarders?A . ./splunk _internal call /services/data/input.3/filemonitorB . ./splunk show config  inputs.confC . ./splunk _internal rest /services/data/inputs/monitorD . ./splunk show config inputsView AnswerAnswer: C Explanation: To view the runtime...

What syntax is required in inputs.conf to ingest data from files or directories?A . A monitor stanza, sourcetype, and Index is required to ingest data.B . A monitor stanza, sourcetype, index, and host is required to ingest data.C . A monitor stanza and sourcetype is required to ingest data.D ....

What is the name of the configuration file where you can specify the source type for a data input?A . limits.conf B. props.conf C. inputs.conf D. transforms.confView AnswerAnswer: B

Which configuration file needs to be edited to configure the universal forwarder to act as a deployment client?A . deploymentclient.conf B. server.conf C. outputs.conf D. inputs.confView AnswerAnswer: A

Which Windows-specific input type allows Splunk software to read special Windows log files such as the DNS debug server log?A . MonitorNoHandle B. Windows Event Log C. Windows Registry D. Windows Management Instrumentation (WMI)View AnswerAnswer: D

What is the name of the default field that stores the timestamps in UNIX time when data is indexed?A . _time B. _timestamp C. _date D. _epochView AnswerAnswer: A

Which type of forwarder is a full Splunk Enterprise instance that can run apps and add-ons?A . Universal forwarder B. Heavy forwarder C. Deployment server D. Search headView AnswerAnswer: B

Which file processor can be used to index files that are not actively written to or updated?A . Monitor B. MonitornoHandle C. Upload D. None of the aboveView AnswerAnswer: A