MENU
In inputs. conf, which stanza would mean Splunk was only reading one local file?
27 comments · newest first
DO
Dong
10 months ago
Wait, are we sure it’s not C? That seems like it could work too!
DO
Domitila
11 months ago
I agree with D, that one file is clear.
VE
Veronika
11 months ago
A is not correct, it's too vague.
LE
Leah
11 months ago
I think it's B, but I'm not 100% sure.
FL
Florinda
11 months ago
Definitely option D, it's specific to that one file.
MI
Mitzie
12 months ago
I lean towards D as well, since it clearly points to that specific crashlog file. It just makes sense!
BE
Bev
12 months ago
I practiced a similar question, and I feel like A is too generic. It doesn't seem right for just one file.
CO
Cory
12 months ago
I'm not entirely sure, but I remember something about the "monitor" stanza being used for specific files. Maybe it's B?
CH
Chantay
1 year ago
I think it's option D because it specifies the exact file path, right? That sounds familiar.
JU
Junita
1 year ago
I'm a bit confused by the different stanza options here. I know the inputs.conf file is used to configure data sources, but I'm not sure how to interpret these specific stanzas. I'll have to think this through carefully.
AD
Adolph
1 year ago
Okay, I've got this. The key is the stanza type - "read://" means Splunk will only read a single local file, while "monitor:/" indicates Splunk will monitor a directory. So the answer has to be A.
SA
Santos
1 year ago
Hmm, I'm not too sure about this one. The question is asking about the inputs.conf file, but the options seem to be using different stanzas. I'll have to review the Splunk documentation on the different stanza types to figure this out.
OR
Oretha
1 year ago
This looks like a straightforward question about Splunk configuration. I think the answer is A, since the "read://" stanza would only read a single local file.
KI
Kimbery
2 years ago
Option B? Really? What is this, amateur hour? Everyone knows Splunk doesn't use colons in its file paths. Clearly A is the correct answer.
CH
Chandra
2 years ago
Pfft, this is easy. Everyone knows you use the 'monitor' stanza to watch directories, not files. A all the way, baby!
GL
Glenna
2 years ago
B) [monitor::/opt/log/crashlog/Jan27crash.txt]
ZO
Zona
2 years ago
Exactly, the 'read' stanza is for reading specific files, not directories.
CA
Carin
2 years ago
A) [read://opt/log/crashlog/Jan27crash.txt]
DE
Deeann
2 years ago
Hmm, I'm torn between A and D. D looks like it's reading the whole directory and a specific file, but A is more straightforward. Decisions, decisions...
JO
Johna
2 years ago
I'm going with C. The '///' in the path means it's reading the entire directory, not just a single file.
RE
Renea
2 years ago
Option A looks right to me, the 'read://' stanza is used for reading a single local file.
WA
Wayne
2 years ago
That's incorrect. The 'monitor://' stanza is used for monitoring directories, not single files.
CA
Casie
2 years ago
C) [monitor:///opt/log/]
DE
Deonna
2 years ago
Yes, that's correct. The 'read://' stanza is used for reading a single local file.
LE
Lemuel
2 years ago
A) [read://opt/log/crashlog/Jan27crash.txt]
AL
Alverta
2 years ago
I disagree, I believe the answer is B) [monitor::/opt/log/crashlog/Jan27crash.txt] because it specifies monitoring a specific file.
ES
Estrella
2 years ago
I think the answer is A) [read://opt/log/crashlog/Jan27crash.txt].