Splunk SPLK-1003 Exam - Topic 3 Question 62 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 62
Topic #: 3

[All SPLK-1003 Questions]

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as

follows: 123-44-5678.

Which configuration file and stanza pair will mask possible SSNs in the log events?

Aprops.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
KEY = _raw

Bprops.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw

Ctransforms.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw

Dtransforms.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$'
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw

Show Suggested Answer

Suggested Answer: D

because transforms.conf is the right configuration file to state the regex expression. https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf

433035

by Deandrea at Nov 21, 2022, 03:41 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lacresha

5 months ago

Why is it in props.conf and not transforms.conf?

upvoted 0 times

...

Cecilia

5 months ago

I disagree, I feel like option D is better.

upvoted 0 times

...

Nathan

6 months ago

Wait, are we sure this regex will work?

upvoted 0 times

...

Francene

6 months ago

I think option A is the right choice!

upvoted 0 times

...

Leonard

6 months ago

The SSN format is definitely 123-44-5678.

upvoted 0 times

...

Rusty

6 months ago

I’m pretty confident that transforms.conf is the right file for masking, but I can't recall if REGEX is the correct term here.

upvoted 0 times

...

Tashia

6 months ago

I feel like I might be mixing up the formats. Wasn't there something about using FORMAT with REX in the last practice?

upvoted 0 times

...

Dusti

6 months ago

I remember practicing a similar question, and I think the key is to use DEST_KEY for the output. That makes me lean towards options B or D.

upvoted 0 times

...

Eleonora

6 months ago

I think the configuration file should be props.conf, but I'm not entirely sure if it's REX or REGEX that we need to use.

upvoted 0 times

...

Amos

6 months ago

An independent project manager to maintain objectivity? I'm not sure that's necessary for every service improvement initiative. I'll have to weigh the trade-offs there.

upvoted 0 times

...

Marshall

6 months ago

This looks like a tricky question. I'll need to carefully read through the details and think it through step-by-step.

upvoted 0 times

...

Princess

6 months ago

This is a tricky one. I'll need to think carefully about how mobile app development has changed and how that might impact the developer-tester relationship.

upvoted 0 times

...

Justa

6 months ago

Hmm, I'm a bit confused about the difference between an ODU and a hybrid coupler. I'll need to review my notes on those components to answer this properly.

upvoted 0 times

...