When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

• A.transforms.conf
• B.props.conf
• C.inputs.conf
• D.outputs.cont

Comment: *

Name: *

Email: *

Verification: *

Li was asked to create a Splunk configuration to monitor syslog files stored on Linux servers at their organization. This configuration will be pushed out to multiple systems via a Splunk app using the on-prem deployment server.
The system administrators have provided Li with a directory listing for the logging locations on three syslog hosts, which are representative of the file structure for all systems collecting this data. An example from each system is shown below:

• A.
• B.
• C.
• D.

Comment: *

Name: *

Email: *

Verification: *

Which of the following would always require raising a support ticket?

• A.Capacity or configuration changes in Splunk Cloud.
• B.Search does not return expected results in Splunk Cloud.
• C.A user is unable to log into Splunk Cloud.
• D.Data is not indexed in Splunk Cloud.

Comment: *

Name: *

Email: *

Verification: *

Which setting in inputs.conf can be used to specify the command to run the script for a scripted input?

• A.script
• B.run
• C.exec
• D.command

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements is true regarding sedcmd?

• A.SEDCMD can be defined in either props.conf or transforms.conf.
• B.SEDCMD does not work on Windows-based installations of Splunk.
• C.SEDCMD uses the same syntax as Splunk's replace command.
• D.SEDCMD provides search and replace functionality using regular expressions and substitutions.

Comment: *

Name: *

Email: *

Verification: *