Free Preparation Discussions
MENU
Splunk SPLK-1005 Exam - Topic 10 Question 20 Discussion
Topic #: 10
Which of the following statements is true about data transformations using SEDCMD?
SEDCMD is a directive used within the props.conf file in Splunk to perform inline data transformations. Specifically, it uses sed-like syntax to modify data as it is being processed.
A . Can only be used to mask or truncate raw data: This is the correct answer because SEDCMD is typically used to mask sensitive data, such as obscuring personally identifiable information (PII) or truncating parts of data to ensure privacy and compliance with security policies. It is not used for more complex transformations such as changing the sourcetype per event.
B . Configured in props.conf and transform.conf: Incorrect, SEDCMD is only configured in props.conf.
C . Can be used to manipulate the sourcetype per event: Incorrect, SEDCMD does not manipulate the s ourcetype.
D . Operates on a REGEX pattern match of the source, sourcetype, or host of an event: Incorrect, while SEDCMD uses regex for matching patterns in the data, it does not operate on the source, sourcetype, or host specifically.
Splunk Documentation Reference:
SEDCMD Usage
Mask Data with SEDCMD
Makeda
2 months agoKristian
2 months agoHermila
2 months agoOctavio
3 months agoGlory
3 months agoHuey
3 months agoMaile
4 months agoKaitlyn
4 months agoDesmond
4 months agoLauran
4 months agoLisbeth
4 months agoKenneth
4 months agoShawn
5 months agoChantay
5 months agoJustine
5 months agoAlyce
5 months agoNicolette
2 months agoRickie
2 months agoJanna
2 months agoGussie
3 months agoAdelle
5 months agoHassie
6 months agoAleta
7 months ago