When indexing a data source, which fields are considered metadata?

• A.source, host, time
• B.time, sourcetype, source
• C.host, raw, sourcetype
• D.sourcetype, source, host

Comment: *

Name: *

Email: *

Verification: *

How would you configure your distsearch conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON A)

B)

C)

D)

• A.option A
• B.Option B
• C.Option C
• D.Option D

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A.props.conf[mask-SSN]REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT = $1<SSN>###-
  ##-$2KEY = _raw
• B.props.conf[mask-SSN]REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT =
  $1<SSN>###-##-$2DEST_KEY = _raw
• C.transforms.conf[mask-SSN]REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT =
  $1<SSN>###-##-$2DEST_KEY = _raw
• D.transforms.conf[mask-SSN]REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"FORMAT =
  $1<SSN>###-##-$2DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

• A.Deployer
• B.Cluster master
• C.Search head cluster master
• D.Deployment server

Comment: *

Name: *

Email: *

Verification: *

What options are available when creating custom roles? (select all that apply)

• A.Restrict search terms
• B.Limit the number of concurrent search jobs
• C.Allow or restrict indexes that can be searched.
• D.Whitelist search terms

Comment: *

Name: *

Email: *

Verification: *