Free Preparation Discussions
MENU
Splunk SPLK-1003 Exam - Topic 15 Question 102 Discussion
Topic #: 15
How is a remote monitor input distributed to forwarders?
The correct answer is B. in props.conf:
[identity]
SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
s/password=([^,|/s]+)/ ####REACTED####/g
The g flag at the end means that the replacement is applied globally, not just to the first match.
Option A is incorrect because it uses the REGEX attribute instead of the SEDCMD attribute. The REGEX attribute is used to extract fields from events, not to modify them.
Option C is incorrect because it uses the transforms.conf file instead of the props.conf file. The transforms.conf file is used to define transformations that can be applied to fields or events, such as lookups, evaluations, or replacements. However, these transformations are applied after indexing, not before.
Option D is incorrect because it uses both the wrong attribute and the wrong file. There is no REGEX-redact_pw attribute in the transforms.conf file.
Adell
4 months agoDarrin
5 months agoRessie
5 months agoDenny
5 months agoLouis
5 months agoLeah
5 months agoIvan
6 months agoJohnson
6 months agoArletta
6 months agoDyan
6 months agoCraig
6 months agoMable
6 months agoLavera
6 months agoGladys
6 months agoWalton
11 months agoBritt
11 months agoShaniqua
11 months agoAngella
10 months agoDolores
10 months agoNana
10 months agoJospeh
11 months agoNieves
10 months agoLucy
11 months agoBrock
11 months agoJohnetta
12 months agoChana
10 months agoJamie
10 months agoIra
10 months agoEloisa
11 months agoGeorgeanna
12 months agoMiesha
1 year agoJesus
1 year ago