Online Access Free SPLK-1005 Exam Questions

Given the following set of files, which of the monitor stanzas below will result in Splunk monitoring all of the files ending with .log?
Files:
/var/log/www1/secure.log
/var/log/www1/access.log
/var/log/www2/logs/secure.log
/var/log/www2/access.log
/var/log/www2/access.log.1

• A.[monitor:///var/log/*/*.log]
• B.[monitor:///var/log/.../*]
• C.[monitor:///var/log/.../*.log]
• D.[monitor:///var/log/*/*]

Which of the following statements is true about data transformations using SEDCMD?

• A.Operates on a REGEX pattern match of the source, sourcetype, or host of an event.
• B.Configured in props.conf and transform.conf.
• C.Can be used to manipulate the sourcetype per event.
• D.Can only be used to mask or truncate raw data.

A user has been asked to mask some sensitive data without tampering with the structure of the file /var/log/purchases/transactions.log that has the following format:
2020-01-01 00:01:20 User=bob SuperSecretNumber=123456789012
Operation=purchase
2020-01-01 16:15:32 User=alice SuperSecretNumber=123456789012
Operation=purchase
Which of the stanzas below will achieve this?

• A.
• B.
• C.
• D.

In which file can the SH0ULD_LINEMERCE setting be modified?

• A.inputs.conf
• B.outputs.conf
• C.props.conf
• D.transforms.conf

Which Splunk component primarily enables distributed searching across multiple indexers and storage repositories simultaneously?

• A.Monitoring Console parses incoming application logs before indexing and long-term searchable storage automatically.
• B.Deployment Servers authenticate distributed searches and archive event repositories for disaster recovery continuously.
• C.Search Heads coordinate distributed searches and present consolidated results to enterprise users centrally.
• D.Universal Forwarders permanently store indexed enterprise logs for historical compliance reporting operations globally.