Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• B.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

An admin oversees an environment with a 1000 GB / day license. The configuration file server.confhas strict_pool_quota=false set. The license is divided into the following three pools, and today's usage is shown on the right-hand column:

Given this, which pool(s) are issued warnings?

• A.Z only
• B.None
• C.All pools
• D.Y and Z

Comment: *

Name: *

Email: *

Verification: *

All search-time field extractions should be specified on which Splunk component?

• A.Deployment server
• B.Universal forwarder
• C.Indexer
• D.Search head

Comment: *

Name: *

Email: *

Verification: *

Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint information for that file?

• A._introspection
• B._audit
• C._thefishbucket
• D._checkpoint

Comment: *

Name: *

Email: *

Verification: *

What is the timespan for which a Splunk Enterprise Trial License is valid?

• A.30 days
• B.60 days
• C.90 days
• D.180 days

Comment: *

Name: *

Email: *

Verification: *