Within props. conf, which stanzas are valid for data modification? (select all that apply)

• A.Sourcetype
• B.Server
• C.Source
• D.Host

Comment: *

Name: *

Email: *

Verification: *

Which layers are involved in Splunk configuration file layering? (select all that apply)

• A.App context
• B.User context
• C.Global context
• D.Forwarder context

Comment: *

Name: *

Email: *

Verification: *

Which forwarder is recommended by Splunk to use in a production environment?

• A.Heavy forwarder
• B.Universal forwarder
• C.Lightweight forwarder
• D.SSL forwarder

Comment: *

Name: *

Email: *

Verification: *

Which parent directory contains the configuration files in Splunk?

• A.SSPLUNK_HCME/var
• B.SSPLUNK_HOME/conf
• C.SSPLUNK_HOME/default
• D.SSFLUNK_KOME/etc

Comment: *

Name: *

Email: *

Verification: *

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309 Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

• A.SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g
• B.SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g
• C.SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g
• D.SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

Comment: *

Name: *

Email: *

Verification: *