Which Splunk component performs indexing and responds to search requests from the search head?

• A.Forwarder
• B.Search head cluster
• C.Search peer
• D.License master

Comment: *

Name: *

Email: *

Verification: *

What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

• A.REGEX, DEST_KEY FORMATTING
• B.REGEX. SRC_KEY, FORMAT
• C.REGEX, DEST_KEY, FORMAT
• D.REGEX, DEST. FORMAT

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• B.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

Which Splunk component does a search head primarily communicate with?

• A.Cluster master
• B.Deployment server
• C.Forwarder
• D.Indexer

Comment: *

Name: *

Email: *

Verification: *

Where can scripts for scripted inputs reside on the host file system? (select all that apply)

• A.$SFLUNK_HOME/bin/scripts
• B.$SPLUNK_HOME/etc/apps/bin
• C.$SPLUNK_HOME/etc/system/bin
• D.$S?LUNK_HOME/etc/apps/<your_app>/bin_

Comment: *

Name: *

Email: *

Verification: *