Which of the following is valid distribute search group?
A)
B)
C)
D)

• A.Option C
• B.Option D
• C.option A
• D.Option B

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
• B.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

Which network input option provides durable file-system buffering of data to mitigate data loss due to network outages and splunkd restarts?

• A.diskQueueSize
• B.durableQueueSizeC persistentOueueSize
• C.queueSize

Comment: *

Name: *

Email: *

Verification: *

Which command will join a Universal Forwarder to a deployment server?

• A.splunk set deploy-poll < IP address/hostname > : < management_port >
• B.splunk join d.server
• C.splunk set deploy-server < IP address/hostname > : < management_port >
• D.splunk join deploy-poll

Comment: *

Name: *

Email: *

Verification: *

Which of the following is true when authenticating users to Splunk using LDAP?

• A.LDAP group names must match the Splunk role name defined in authorize.conf.
• B.Splunk only supports encrypted LDAP connections.
• C.Splunk will search each LDAP strategy in the order in which they are listed in authentication.conf.
• D.LDAP will take precedence over local users with the same username as defined in etc/passwd.

Comment: *

Name: *

Email: *

Verification: *