Splunk SPLK-1005 Exam - Topic 3 Question 1 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 1
Topic #: 3

A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?

Aprops. conf on a Splunk Cloud search head,

Bprops.conf on a Heavy Forwarder.

Ctransforms, cent on a Splunk Cloud indexer.

Dprops. conf- on a Universal Forwarder.

Show Suggested Answer

Suggested Answer: B

To mask unstructured data before sending it to Splunk Cloud, the SEDCMD should be configured in the props.conf file on a Heavy Forwarder. The Heavy Forwarder is responsible for data parsing and transformation before forwarding the data to Splunk Cloud. This ensures that sensitive data is masked before it reaches the indexing stage.

Splunk Documentation Reference: Using SEDCMD to Mask Data

by Dan at Oct 19, 2024, 11:46 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Noemi

6 months ago

I agree with B, it's the right spot for SEBCMD!

upvoted 0 times

...

Leonida

6 months ago

Wait, can you really do it on a Universal Forwarder?

upvoted 0 times

...

Felicidad

6 months ago

C seems off, isn't that for indexing?

upvoted 0 times

...

Avery

7 months ago

I thought it was A, but B makes sense too.

upvoted 0 times

...

Geoffrey

7 months ago

Definitely B, that's where you configure it.

upvoted 0 times

...

Della

7 months ago

I feel like the Universal Forwarder is the right answer for this one, but I need to double-check if it’s the correct context for masking unstructured data.

upvoted 0 times

...

Ilene

7 months ago

I’m a bit confused. I thought props.conf was mainly for the indexer, but I can't recall if that applies to SEBCMD specifically.

upvoted 0 times

...

Hayley

7 months ago

I remember practicing a question about configuring props.conf, and I feel like it was on the Heavy Forwarder. That might be the right choice here.

upvoted 0 times

...

Monte

8 months ago

I think we discussed that SEBCMD is related to data masking, but I'm not sure if it goes on the Heavy Forwarder or the Universal Forwarder.

upvoted 0 times

...

Davida

8 months ago

Based on the options, I think the answer is B. The props.conf file on a Heavy Forwarder seems like the right place to configure data masking before sending data to Splunk Cloud.

upvoted 0 times

...

Miriam

8 months ago

I'm a bit confused here. Is the SEBCMD a Splunk command or some external tool? I'll need to review my Splunk knowledge to figure this out.

upvoted 0 times

...

Nieves

8 months ago

Okay, let's see. The question mentions Splunk Cloud, so I'm guessing the answer has to do with the Splunk Cloud environment. Maybe it's on the search head?

upvoted 0 times

...

Ronna

8 months ago

Hmm, this one seems tricky. I'll need to think through the Splunk architecture and where data masking would typically be configured.

upvoted 0 times

...

Judy

2 years ago

D) props. conf on a Universal Forwarder. Universal, like my ability to confuse myself with all these options. Cheers!

upvoted 0 times

Brendan

1 year ago

D) props. conf- on a Universal Forwarder

upvoted 0 times

...

Alexia

1 year ago

C) transforms, cent on a Splunk Cloud indexer

upvoted 0 times

...

Daniel

1 year ago

B) props.conf on a Heavy Forwarder

upvoted 0 times

...

Jesusita

1 year ago

A) props. conf on a Splunk Cloud search head

upvoted 0 times

...

Reuben

2 years ago

B) props.conf on a Heavy Forwarder. Heavy as in, I'm heavy on the correct answers. Bring it on!

upvoted 0 times

...

Paz

2 years ago

C) transforms, cent on a Splunk Cloud indexer. Sounds like a party trick to me. Let's see if it can do the hokey-pokey too.

upvoted 0 times

Gabriele

1 year ago

D) props. conf- on a Universal Forwarder.

upvoted 0 times

...

Margarita

1 year ago

C) transforms, cent on a Splunk Cloud indexer.

upvoted 0 times

...

Matthew

2 years ago

B) props.conf on a Heavy Forwarder.

upvoted 0 times

...

Bo

2 years ago

A) props. conf on a Splunk Cloud search head.

upvoted 0 times

...

Sharen

2 years ago

D) props. conf on a Universal Forwarder. Universal, just like my knowledge on this topic. Boom!

upvoted 0 times

...

Ashton

2 years ago

A) props. conf on a Splunk Cloud search head. I mean, why complicate things, right? Just let the big guns handle it.

upvoted 0 times

Antonio

2 years ago

A) props. conf on a Splunk Cloud search head. It's easier to manage that way.

upvoted 0 times

...

Glory

2 years ago

B) props.conf on a Heavy Forwarder. But wouldn't it be better to do it on the search head?

upvoted 0 times

...

Paris

2 years ago

A) props. conf on a Splunk Cloud search head. I agree, keep it simple.

upvoted 0 times

...

Kris

2 years ago

B) props.conf on a Heavy Forwarder. That's the way to go, folks. Keep it simple, you know?

upvoted 0 times

Bettina

2 years ago

C) transforms, cent on a Splunk Cloud indexer.

upvoted 0 times

...

Cristina

2 years ago

B) props.conf on a Heavy Forwarder.

upvoted 0 times

...

Patti

2 years ago

A) props. conf on a Splunk Cloud search head.

upvoted 0 times

...

Romana

2 years ago

I agree with Virgie, because Heavy Forwarders are responsible for data routing and transformation before sending it to the indexer.

upvoted 0 times

...

Virgie

2 years ago

I think SEBCMD should be configured in props.conf on a Heavy Forwarder.

upvoted 0 times

...