Splunk Exam SPLK-1003 Topic 12 Question 65 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 65
Topic #: 12

[All SPLK-1003 Questions]

Which of the following statements apply to directory inputs? {select all that apply)

AAll discovered text files are consumed.

BCompressed files are ignored by default

CSplunk recursively traverses through the directory structure.

DWhen adding new log files to a monitored directory, the forwarder must be restarted to take them into account.

Show Suggested Answer

Suggested Answer: C

Reference https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Configurationparametersandthedatapipeline

by Jutta at Jan 09, 2023, 06:30 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lashawn

2 months ago

Ah, the age-old directory input dilemma. A, C, and D are like the holy trinity of Splunk knowledge. As for B, it's probably just there to see who's paying attention. I bet the Splunk devs have a good laugh every time someone gets caught out by that one.

upvoted 0 times

...

Dorthy

2 months ago

Hmm, let me think... A, C, and D sound right. But B? Really? Maybe Splunk is trying to trick us here. I bet the compressed files are actually consumed by default. Time to consult the Splunk docs again...

upvoted 0 times

Otis

28 days ago

Yeah, it's always good to verify before making any assumptions.

upvoted 0 times

...

Olga

1 months ago

I agree, let's double check the Splunk documentation to be sure.

upvoted 0 times

...

Nickie

1 months ago

I think A, C, and D are correct. B does seem a bit suspicious.

upvoted 0 times

...

Sharen

2 months ago

I think I got it figured out. A, C, and D are correct. As for the compressed files, who cares? Just unzip them first and let Splunk do its thing. Easy peasy!

upvoted 0 times

Marguerita

1 months ago

It's important to restart the forwarder when adding new log files to a monitored directory.

upvoted 0 times

...

Darrin

1 months ago

Yeah, just unzip the compressed files before adding them to Splunk.

upvoted 0 times

...

Francene

2 months ago

I agree, A, C, and D are the correct statements for directory inputs.

upvoted 0 times

...

Rory

3 months ago

Hah, this is an easy one! A, C, and D are definitely right. I always forget about that compressed file thing though. Is it B or the other way around? Anyway, I'm confident I'll nail this question.

upvoted 0 times

Mariann

28 days ago

Definitely. I'm feeling confident about this question now.

upvoted 0 times

...

Wilda

29 days ago

I always forget about the compressed files too. Good thing we're reviewing this.

upvoted 0 times

...

Leonardo

1 months ago

Yeah, that's correct. A, C, and D are the right statements.

upvoted 0 times

...

Rory

1 months ago

I think it's B. Compressed files are ignored by default.

upvoted 0 times

...

Junita

1 months ago

Definitely. I'm feeling confident about this question now.

upvoted 0 times

...

Johanna

1 months ago

I always forget about the compressed files too. Good thing we're reviewing this.

upvoted 0 times

...

Paulene

2 months ago

Yeah, you're right. A, C, and D are the correct statements.

upvoted 0 times

...

Nathalie

3 months ago

I think it's B. Compressed files are ignored by default.

upvoted 0 times

...

Sage

3 months ago

I'm not sure about D) though. Restarting the forwarder seems like a hassle.

upvoted 0 times

...

Sylvia

3 months ago

I'm pretty sure A, C, and D are correct. Splunk definitely recursively traverses directories, and the forwarder needs to be restarted to pick up new log files. But I'm not sure about the compressed files - I thought Splunk could handle those too.

upvoted 0 times