Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

• A.splunk btool server list --debug
• B.splunk list forward-indexer
• C.splunk list forward-server
• D.splunk btool indexes list --debug

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
• B.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

What is the correct order of steps in Duo Multifactor Authentication?

• A.1. Request Login
  2. Connect to SAML server
  3. Duo MFA
  4. Create User session
  5. Authentication Granted
  6. Log into Splunk
• B.1. Request Login
  2. Duo MFA
  3. Authentication Granted
  4. Connect to SAML server
  5. Log into Splunk
  6. Create User session
• C.1. Request Login
  2. Check authentication / group mapping
  3. Authentication Granted
  4. Duo MFA
  5. Create User session
  6. Log into Splunk
• D.1. Request Login
  2. Duo MFA
  3. Check authentication / group mapping
  4. Create User session
  5.Authentication Granted
  6. Log into Splunk

Comment: *

Name: *

Email: *

Verification: *

There is an application cluster that produces logs with ISO-8859-5 character encoding.
Where should the props.confsetting be deployed to make these logs usable in Splunk?

• A.On the Search Head
• B.On the Indexers
• C.On the Management Console
• D.On the Universal Forwarders

Comment: *

Name: *

Email: *

Verification: *

Which of the following methods will connect a deployment client to a deployment server? (select all that apply)

• A.Run $SPLUNK_ROME/bin/ splunk set deploy-poll : from the command line of the deployment client.
• B.Create and edit a deploymentserver . conf file in SSPLVNE{ on the deployment server.
• C.Create and edit a deploymentclient . conf file in SSPLTJNE( EOME/etc/ system/local on the deployment client.
• D.Run $SPLUNK ROME/bin/spiunk set deploy-poi i : from the command line of the deployment server.

Comment: *

Name: *

Email: *

Verification: *