Discuss Splunk SPLK-1003 Exam Topic 15 Question 102

How is a remote monitor input distributed to forwarders?

AAs an app.

BAs a forward.conf file.

CAs a monitor.conf file.

DAs a forwarder monitor profile.

Suggested Answer: B

The correct answer is B. in props.conf:

[identity]

SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

According to the Splunk documentation1, to redact sensitive data from raw events, you need to use the SEDCMD attribute in the props.conf file. The SEDCMD attribute applies a sed expression to the raw data before indexing. The sed expression can use the s command to replace a pattern with a substitution string. For example, the following sed expression replaces any occurrence of password= followed by any characters until a comma, whitespace, or slash with ####REACTED####:

s/password=([^,|/s]+)/ ####REACTED####/g

The g flag at the end means that the replacement is applied globally, not just to the first match.

Option A is incorrect because it uses the REGEX attribute instead of the SEDCMD attribute. The REGEX attribute is used to extract fields from events, not to modify them.

Option C is incorrect because it uses the transforms.conf file instead of the props.conf file. The transforms.conf file is used to define transformations that can be applied to fields or events, such as lookups, evaluations, or replacements. However, these transformations are applied after indexing, not before.

Option D is incorrect because it uses both the wrong attribute and the wrong file. There is no REGEX-redact_pw attribute in the transforms.conf file.

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Adell 10 months ago

I doubt it's a forwarder monitor profile.

Darrin 11 months ago

Wait, is it really just that simple?

Ressie 11 months ago

Agree, forward.conf is the way to go!

Denny 11 months ago

I thought it was monitor.conf?

Louis 11 months ago

It's definitely as a forward.conf file.

Leah 12 months ago

I’m leaning towards the app option, but I need to double-check my notes on this topic.

Ivan 12 months ago

I’m a bit confused; I thought it was related to the forwarder monitor profile, but I can't recall the details.

Johnson 12 months ago

I remember practicing a similar question, and I feel like it might be the monitor.conf file instead.

Arletta 1 year ago

I think the remote monitor input is distributed as a forward.conf file, but I'm not entirely sure.

Dyan 1 year ago

This is a good question to test our understanding of forwarder configurations. I'll carefully consider each option and select the one that best matches how remote monitor input is distributed.

Craig 1 year ago

I'm a little confused by the wording of this question. Let me re-read it and think through the possible answers before selecting one.

Mable 1 year ago

Okay, I've got this. The remote monitor input is distributed to forwarders as a forwarder monitor profile. Option D is the correct answer.

Lavera 1 year ago

Hmm, I'm a bit unsure about this one. I'll need to review my notes on forwarder configurations to make sure I understand the right way to distribute remote monitor input.

Gladys 1 year ago

This seems like a straightforward question about how remote monitor input is distributed to forwarders. I'll need to think through the different options carefully.

Walton 1 year ago

Option A? Really? Who would distribute a monitor input as an app? That's just silly.

Britt 1 year ago

Definitely not an app! It's gotta be one of the configuration file options. I'm leaning towards B or D.

Shaniqua 1 year ago

Hmm, I'm not sure about this one. Maybe it's distributed as a monitor.conf file? Option C seems plausible.

Angella 1 year ago

↳ replying to Shaniqua

I'm not entirely sure, but I think it could be distributed as an app. Option A seems like a possibility.

Dolores 1 year ago

↳ replying to Shaniqua

I believe it's set up as a forwarder monitor profile. Option D sounds like the right choice.

Nana 1 year ago

↳ replying to Shaniqua

I think it's actually distributed as a forward.conf file. Option B might be the correct answer.

Jospeh 1 year ago

D sounds like the correct answer to me. A forwarder monitor profile would be the way to distribute the remote monitor input.

Nieves 1 year ago

↳ replying to Jospeh

Yes, D does sound like the correct answer. It's important to set up the forwarder monitor profile properly for efficient distribution.

Lucy 1 year ago

↳ replying to Jospeh

I agree, using a forwarder monitor profile seems like the most logical way to distribute remote monitor input.

Brock 1 year ago

↳ replying to Jospeh

I think D is the correct answer too. It makes sense to use a forwarder monitor profile for distributing remote monitor input.

Johnetta 1 year ago

I think it's option B. The remote monitor input must be distributed through the forward.conf file.

Chana 1 year ago

↳ replying to Johnetta

Actually, it's not a forwarder monitor profile. It's distributed through the forward.conf file.

Jamie 1 year ago

↳ replying to Johnetta

I think it's a forwarder monitor profile.

Ira 1 year ago

↳ replying to Johnetta

Yes, that's correct. It's specified in the forward.conf file.

Eloisa 1 year ago

↳ replying to Johnetta

I agree, the remote monitor input is distributed through the forward.conf file.

Georgeanna 1 year ago

I'm not sure, but I think it could also be D) As a forwarder monitor profile.

Miesha 2 years ago

I agree with Jesus, because the forward.conf file is used to configure inputs for forwarders.

Jesus 2 years ago

I think the answer is B) As a forward.conf file.

Splunk SPLK-1003 Exam - Topic 15 Question 102 Discussion