In which phase of the index time process does the license metering occur?

• A.input phase
• B.Parsing phase
• C.Indexing phase
• D.Licensing phase

Comment: *

Name: *

Email: *

Verification: *

Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

• A.props.conf
• B.inputs.conf
• C.rawdata.conf
• D.transforms.conf

Comment: *

Name: *

Email: *

Verification: *

Which Splunk component performs indexing and responds to search requests from the search head?

• A.Forwarder
• B.Search peer
• C.License master
• D.Search head cluster

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• B.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

How can native authentication be disabled in Splunk?

• A.Remove the $SPLUNK_HOME/etc/passwdfile
• B.Create an empty $SPLUNK_HOME/etc/passwdfile
• C.Set SPLUNK_AUTHENTICATION=falsein splunk-launch.conf
• D.Set nativeAuthentication=falsein authentication.conf

Comment: *

Name: *

Email: *

Verification: *