Within props. conf, which stanzas are valid for data modification? (select all that apply)

• A.Host
• B.Server
• C.Source
• D.Sourcetype

Comment: *

Name: *

Email: *

Verification: *

Which artifact is required in the request header when creating an HTTP event?

• A.ackID
• B.Token
• C.Manifest
• D.Host name

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
• B.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

What options are available when creating custom roles? (select all that apply)

• A.Restrict search terms
• B.Whitelist search terms
• C.Limit the number of concurrent search jobs
• D.Allow or restrict indexes that can be searched.

Comment: *

Name: *

Email: *

Verification: *

In inputs. conf, which stanza would mean Splunk was only reading one local file?

• A.[read://opt/log/crashlog/Jan27crash.txt]
• B.[monitor::/ opt/log/crashlog/Jan27crash.txt]
• C.[monitor:/// opt/log/]
• D.[monitor:/// opt/log/ crashlog/Jan27crash.txt]

Comment: *

Name: *

Email: *

Verification: *