MENU
A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?
Suggested Answer: B
Get Premium SPLK-1005 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
To mask unstructured data before sending it to Splunk Cloud, the SEDCMD should be configured in the props.conf file on a Heavy Forwarder. The Heavy Forwarder is responsible for data parsing and transformation before forwarding the data to Splunk Cloud. This ensures that sensitive data is masked before it reaches the indexing stage.
Splunk Documentation Reference: Using SEDCMD to Mask Data
35 comments · newest first
NO
Noemi
10 months ago
I agree with B, it's the right spot for SEBCMD!
LE
Leonida
11 months ago
Wait, can you really do it on a Universal Forwarder?
FE
Felicidad
11 months ago
C seems off, isn't that for indexing?
AV
Avery
11 months ago
I thought it was A, but B makes sense too.
GE
Geoffrey
11 months ago
Definitely B, that's where you configure it.
DE
Della
12 months ago
I feel like the Universal Forwarder is the right answer for this one, but I need to double-check if it’s the correct context for masking unstructured data.
IL
Ilene
12 months ago
I’m a bit confused. I thought props.conf was mainly for the indexer, but I can't recall if that applies to SEBCMD specifically.
HA
Hayley
12 months ago
I remember practicing a question about configuring props.conf, and I feel like it was on the Heavy Forwarder. That might be the right choice here.
MO
Monte
1 year ago
I think we discussed that SEBCMD is related to data masking, but I'm not sure if it goes on the Heavy Forwarder or the Universal Forwarder.
DA
Davida
1 year ago
Based on the options, I think the answer is B. The props.conf file on a Heavy Forwarder seems like the right place to configure data masking before sending data to Splunk Cloud.
MI
Miriam
1 year ago
I'm a bit confused here. Is the SEBCMD a Splunk command or some external tool? I'll need to review my Splunk knowledge to figure this out.
NI
Nieves
1 year ago
Okay, let's see. The question mentions Splunk Cloud, so I'm guessing the answer has to do with the Splunk Cloud environment. Maybe it's on the search head?
RO
Ronna
1 year ago
Hmm, this one seems tricky. I'll need to think through the Splunk architecture and where data masking would typically be configured.
JU
Judy
2 years ago
D) props. conf on a Universal Forwarder. Universal, like my ability to confuse myself with all these options. Cheers!
BR
Brendan
2 years ago
D) props. conf- on a Universal Forwarder
AL
Alexia
2 years ago
C) transforms, cent on a Splunk Cloud indexer
DA
Daniel
2 years ago
B) props.conf on a Heavy Forwarder
JE
Jesusita
2 years ago
A) props. conf on a Splunk Cloud search head
RE
Reuben
2 years ago
B) props.conf on a Heavy Forwarder. Heavy as in, I'm heavy on the correct answers. Bring it on!
PA
Paz
2 years ago
C) transforms, cent on a Splunk Cloud indexer. Sounds like a party trick to me. Let's see if it can do the hokey-pokey too.
GA
Gabriele
2 years ago
D) props. conf- on a Universal Forwarder.
MA
Margarita
2 years ago
C) transforms, cent on a Splunk Cloud indexer.
MA
Matthew
2 years ago
B) props.conf on a Heavy Forwarder.
BO
Bo
2 years ago
A) props. conf on a Splunk Cloud search head.
SH
Sharen
2 years ago
D) props. conf on a Universal Forwarder. Universal, just like my knowledge on this topic. Boom!
AS
Ashton
2 years ago
A) props. conf on a Splunk Cloud search head. I mean, why complicate things, right? Just let the big guns handle it.
AN
Antonio
2 years ago
A) props. conf on a Splunk Cloud search head. It's easier to manage that way.
GL
Glory
2 years ago
B) props.conf on a Heavy Forwarder. But wouldn't it be better to do it on the search head?
PA
Paris
2 years ago
A) props. conf on a Splunk Cloud search head. I agree, keep it simple.
KR
Kris
2 years ago
B) props.conf on a Heavy Forwarder. That's the way to go, folks. Keep it simple, you know?
BE
Bettina
2 years ago
C) transforms, cent on a Splunk Cloud indexer.
CR
Cristina
2 years ago
B) props.conf on a Heavy Forwarder.
PA
Patti
2 years ago
A) props. conf on a Splunk Cloud search head.
RO
Romana
2 years ago
I agree with Virgie, because Heavy Forwarders are responsible for data routing and transformation before sending it to the indexer.
VI
Virgie
2 years ago
I think SEBCMD should be configured in props.conf on a Heavy Forwarder.