Online Access Free SPLK-1005 Practice Test

A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?

• A.props. conf- on a Universal Forwarder.
• B.props. conf on a Splunk Cloud search head,
• C.transforms, cent on a Splunk Cloud indexer.
• D.props.conf on a Heavy Forwarder.

The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

• A.The value of the TZ attribute in props. cont for the a :ces3_ccwbined sourcetype.
• B.The time zone of the Heavy/Intermediate Forwarder with the monitor input.
• C.The value of the TZ attribute in props, conf for the my.webserver.example host.
• D.The time zone indicator in the raw event data.

Which of the following are default Splunk Cloud user roles?

• A.can delete, users, admin
• B.apps, power, sc_admin
• C.power, user, admin
• D.must_delete, power, sc_admin

Windows Input types are collected in Splunk via a script which is configurable using the GUI. What is this type of input called?

• A.Scripted
• B.Modular
• C.Batch
• D.Front-end

What syntax is required in inputs.conf to ingest data from files or directories?

• A.A monitor stanza and sourcetype is required to ingest data.
• B.A monitor stanza, sourcetype, and Index is required to ingest data.
• C.A monitor stanza, sourcetype, index, and host is required to ingest data.
• D.Only the monitor stanza is required to ingest data.