BlackFriday 2024! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Splunk Exam SPLK-1003 Topic 4 Question 105 Discussion

Actual exam question for Splunk's SPLK-1003 exam
Question #: 105
Topic #: 4
[All SPLK-1003 Questions]

In inputs. conf, which stanza would mean Splunk was only reading one local file?

Show Suggested Answer Hide Answer
Suggested Answer: B

[monitor::/opt/log/crashlog/Jan27crash.txt].This stanza means that Splunk is monitoring a single local file named Jan27crash.txt in the /opt/log/crashlog/ directory1.The monitor input type is used to monitor files and directories for changes and index any new data that is added2.


by Rafael at Nov 29, 2024, 10:19 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Renea
11 hours ago
Option A looks right to me, the 'read://' stanza is used for reading a single local file.
upvoted 0 times
...
Alverta
1 days ago
I disagree, I believe the answer is B) [monitor::/opt/log/crashlog/Jan27crash.txt] because it specifies monitoring a specific file.
upvoted 0 times
...
Estrella
2 days ago
I think the answer is A) [read://opt/log/crashlog/Jan27crash.txt].
upvoted 0 times
...

Save Cancel