Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log

• A.[monitor:///var/log/.../secure.*
• B.[monitor:///var/log/www1/secure.*]
• C.[monitor:///var/log/www1/secure.log]
• D.[monitor:///var/log/www*/secure.*]

Comment: *

Name: *

Email: *

Verification: *

The priority of layered Splunk configuration files depends on the file's:

• A.Weight
• B.Creation time
• C.Owner
• D.Context

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
• B.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

• A.inputs.conf
• B.monitor.conf
• C.outputs.conf
• D.forwarder.conf

Comment: *

Name: *

Email: *

Verification: *

The following stanza is active in indexes.conf:
[cat_facts]
maxHotSpanSecs = 3600
frozenTimePeriodInSecs = 2630000
maxTota1DataSizeMB = 650000
All other related indexes.conf settings are default values.
If the event timestamp was 3739283 seconds ago, will it be searchable?

• A.Yes, only if the bucket is still hot.
• B.No, because the index will have exceeded its maximum size.
• C.Yes, only if the index size is also below 650000 MB.
• D.No, because the event time is greater than the retention time.

Comment: *

Name: *

Email: *

Verification: *