Discuss Splunk SPLK-1005 Exam Topic 9 Question 30

Given the following set of files, which of the monitor stanzas below will result in Splunk monitoring all of the files ending with .log?

Files:

/var/log/www1/secure.log

/var/log/www1/access.log

/var/log/www2/logs/secure.log

/var/log/www2/access.log

/var/log/www2/access.log.1

A[monitor:///var/log/*/*.log]

B[monitor:///var/log/.../*.log]

C[monitor:///var/log/*/*]

D[monitor:///var/log/.../*]

Suggested Answer: B

The ellipsis (...) in [monitor:///var/log/.../*.log] allows Splunk to monitor files ending in .log in all nested directories under /var/log/. [Reference: Splunk Docs on monitor stanza syntax]

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

22 comments · newest first

Ammie 2 days ago

I agree with Keneth, B is the best choice.

Jesusita 7 days ago

Option C won't catch the .log files in deeper folders.

Keneth 12 days ago

I prefer option B. It covers all subdirectories.

Kanisha 17 days ago

I think option A is too restrictive.

Audra 23 days ago

I disagree, A is too restrictive for this case.

Diane 28 days ago

I’m surprised that B works for nested directories!

Rana 1 month ago

Wait, does D even include .log files?

Patrick 1 month ago

I think A is the right choice, it looks good to me.

Val 1 month ago

Option B will catch all .log files.

Basilia 2 months ago

Wait, are we sure B) covers everything? Seems too good to be true!

Ilene 2 months ago

D) doesn't specify .log, so it won't work for this.

Melynda 2 months ago

I think C) is too broad, it includes non-log files.

Mitzie 2 months ago

B) is the right choice, it captures all .log files!

Glendora 2 months ago

A) only catches logs in one level, not all .log files.

Dahlia 2 months ago

I have a hunch that option D might work, but I can't recall if it captures the .log files specifically.

Alfreda 3 months ago

I practiced a similar question, and I feel like option A could be too restrictive since it only goes two levels deep.

Derick 3 months ago

I'm not entirely sure, but I remember that the wildcard * might not capture files in subdirectories correctly.

Mattie 3 months ago

I think option B looks familiar because it uses the ellipsis, which might help capture all the nested directories.

Bulah 3 months ago

I’m leaning towards option A, but I’m not confident it captures everything since it might miss files in nested folders.

Katheryn 3 months ago

I practiced a similar question, and I feel like the option with the ellipsis is usually the right choice for deeper directory structures.

Lucina 4 months ago

I'm not entirely sure, but I remember something about the asterisk being less specific than the ellipsis. Could that affect the results?

Phyliss 5 months ago

I think option B looks familiar because it uses the ellipsis, which might help in capturing all subdirectories.

Splunk SPLK-1005 Exam - Topic 9 Question 30 Discussion