Which of the following are methods for adding inputs in Splunk? (select all that apply)

• A.Editing monitor. conf
• B.Editing inputs. conf
• C.Splunk Web
• D.CLI

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
• B.props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C.transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D.transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

Consider the following stanza ininputs.conf:

What will the value of the source filed be for events generated by this scripts input?

• A./opt/splunk/ecc/apps/search/bin/liscer.sh
• B.unknown
• C.liscer
• D.liscer.sh

Comment: *

Name: *

Email: *

Verification: *

What options are available when creating custom roles? (Choose all that apply.)

• A.Restrict search terms.
• B.Whitelist search terms.
• C.Limit the number of concurrent search jobs.
• D.Allow or restrict indexes that can be searched.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is a valid distributed search group?
[distributedSearch:Paris]

• A.default = false
  servers = server1, server2
• B.[searchGroup:Paris]
  default = false
  servers = server1:8089, server2:8089
  [searchGroup:Paris]
• C.default = false
  servers = server1:9997, server2:9997
  [distributedSearch:Paris]
• D.default = false
  servers = server1:8089; server2:8089

Comment: *

Name: *

Email: *

Verification: *