Discuss Splunk SPLK-1003 Exam Topic 3 Question 62

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as

follows: 123-44-5678.

Which configuration file and stanza pair will mask possible SSNs in the log events?

Aprops.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
KEY = _raw

Bprops.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw

Ctransforms.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw

Dtransforms.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw

Suggested Answer: D

because transforms.conf is the right configuration file to state the regex expression. https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf

433035

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Lacresha 11 months ago

Why is it in props.conf and not transforms.conf?

Cecilia 11 months ago

I disagree, I feel like option D is better.

Nathan 12 months ago

Wait, are we sure this regex will work?

Francene 12 months ago

I think option A is the right choice!

Leonard 12 months ago

The SSN format is definitely 123-44-5678.

Rusty 1 year ago

I’m pretty confident that transforms.conf is the right file for masking, but I can't recall if REGEX is the correct term here.

Tashia 1 year ago

I feel like I might be mixing up the formats. Wasn't there something about using FORMAT with REX in the last practice?

Dusti 1 year ago

I remember practicing a similar question, and I think the key is to use DEST_KEY for the output. That makes me lean towards options B or D.

Eleonora 1 year ago

I think the configuration file should be props.conf, but I'm not entirely sure if it's REX or REGEX that we need to use.

Amos 1 year ago

An independent project manager to maintain objectivity? I'm not sure that's necessary for every service improvement initiative. I'll have to weigh the trade-offs there.

Marshall 1 year ago

This looks like a tricky question. I'll need to carefully read through the details and think it through step-by-step.

Princess 1 year ago

This is a tricky one. I'll need to think carefully about how mobile app development has changed and how that might impact the developer-tester relationship.

Justa 1 year ago

Hmm, I'm a bit confused about the difference between an ODU and a hybrid coupler. I'll need to review my notes on those components to answer this properly.

Splunk SPLK-1003 Exam - Topic 3 Question 62 Discussion