When running the command shown below, what is the default path in which deployment server. conf is created?
splunk set deploy-poll deployServer:port

• A.SFLUNK_HOME/etc/deployment
• B.SPLUNK_HOME/etc/system/local
• C.SPLUNK_HOME/etc/system/default
• D.SPLUNK_KOME/etc/apps/deployment

Comment: *

Name: *

Email: *

Verification: *

What options are available when creating custom roles? (select all that apply)

• A.Restrict search terms
• B.Limit the number of concurrent search jobs
• C.Allow or restrict indexes that can be searched.
• D.Whitelist search terms

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
• B.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

Which forwarder type can parse data prior to forwarding?

• A.Hyper forwarder
• B.Heaviest forwarder
• C.Universal forwarder
• D.Heavy forwarder

Comment: *

Name: *

Email: *

Verification: *

Which of the following enables compression for universal forwarders in outputs. conf ?
A)

B)

C)

D)

• A.Option D
• B.Option C
• C.Option B
• D.Option A

Comment: *

Name: *

Email: *

Verification: *