Free Preparation Discussions
MENU
Splunk SPLK-1003 Exam - Topic 15 Question 102 Discussion
Topic #: 15
How is a remote monitor input distributed to forwarders?
The correct answer is B. in props.conf:
[identity]
SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
s/password=([^,|/s]+)/ ####REACTED####/g
The g flag at the end means that the replacement is applied globally, not just to the first match.
Option A is incorrect because it uses the REGEX attribute instead of the SEDCMD attribute. The REGEX attribute is used to extract fields from events, not to modify them.
Option C is incorrect because it uses the transforms.conf file instead of the props.conf file. The transforms.conf file is used to define transformations that can be applied to fields or events, such as lookups, evaluations, or replacements. However, these transformations are applied after indexing, not before.
Option D is incorrect because it uses both the wrong attribute and the wrong file. There is no REGEX-redact_pw attribute in the transforms.conf file.
Adell
3 months agoDarrin
3 months agoRessie
3 months agoDenny
4 months agoLouis
4 months agoLeah
4 months agoIvan
4 months agoJohnson
4 months agoArletta
5 months agoDyan
5 months agoCraig
5 months agoMable
5 months agoLavera
5 months agoGladys
5 months agoWalton
9 months agoBritt
10 months agoShaniqua
10 months agoAngella
8 months agoDolores
9 months agoNana
9 months agoJospeh
10 months agoNieves
9 months agoLucy
9 months agoBrock
9 months agoJohnetta
10 months agoChana
9 months agoJamie
9 months agoIra
9 months agoEloisa
10 months agoGeorgeanna
10 months agoMiesha
11 months agoJesus
11 months ago