Splunk SPLK-1005 Exam - Topic 9 Question 30 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 30
Topic #: 9

Given the following set of files, which of the monitor stanzas below will result in Splunk monitoring all of the files ending with .log?

Files:

/var/log/www1/secure.log

/var/log/www1/access.log

/var/log/www2/logs/secure.log

/var/log/www2/access.log

/var/log/www2/access.log.1

A[monitor:///var/log/*/*.log]

B[monitor:///var/log/.../*.log]

C[monitor:///var/log/*/*]

D[monitor:///var/log/.../*]

Show Suggested Answer

Suggested Answer: B

The ellipsis (...) in [monitor:///var/log/.../*.log] allows Splunk to monitor files ending in .log in all nested directories under /var/log/. [Reference: Splunk Docs on monitor stanza syntax]

by Tammara at May 13, 2026, 07:40 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Phyliss

16 days ago

I think option B looks familiar because it uses the ellipsis, which might help in capturing all subdirectories.

upvoted 0 times

...