What are the required stanza attributes when configuring the transforms.confto manipulate or remove events?

• A.REGEX, DEST, FORMAT
• B.REGEX, SRC_KEY, FORMAT
• C.REGEX, DEST_KEY, FORMAT
• D.REGEX, DEST_KEY, FORMATTING

Comment: *

Name: *

Email: *

Verification: *

How does the Monitoring Console monitor forwarders?

• A.By using the forwarder monitoring add-on
• B.With internal logs forwarded by deployment server.
• C.By pulling internal logs from forwarders.
• D.With internal logs forwarded by forwarders.

Comment: *

Name: *

Email: *

Verification: *

How does the Monitoring Console monitor forwarders?

• A.With internal logs forwarded by deployment server.
• B.With internal logs forwarded by forwarders.
• C.By using the forwarder monitoring add-on
• D.By pulling internal logs from forwarders.

Comment: *

Name: *

Email: *

Verification: *

Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

• A.props.conf
• B.inputs.conf
• C.rawdata.conf
• D.transforms.conf

Comment: *

Name: *

Email: *

Verification: *

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309 Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

• A.SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g
• B.SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g
• C.SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g
• D.SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

Comment: *

Name: *

Email: *

Verification: *