Splunk Exam SPLK-1005 Topic 9 Question 8 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 8
Topic #: 9

[All SPLK-1005 Questions]

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

AThis can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.

BThe configuration changes can be made using Splunk Web. CU, directly in configuration files, or via a deployment app.

CThe configuration changes can be made using CU, directly in configuration files, or via a deployment app.

DIt is only possible to make this change directly in configuration files or via a deployment app.

Show Suggested Answer

Suggested Answer: B

When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.

Splunk Documentation Reference: props.conf configuration

by Chaya at Dec 09, 2024, 05:34 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Renea

4 days ago

Hmm, this question is making me hungry. I wonder if there's a 'Universal Forwarder Sandwich' on the menu today? Anyway, I'm gonna go with option C - can't go wrong with the classic config file approach. Less chance of accidentally clicking the wrong button and ending up with a 'Universal Disaster' on my hands!

upvoted 0 times

...

Dalene

5 days ago

Ooh, option A sounds a bit too restrictive. I mean, come on, Splunk is all about flexibility, right? Option B is the way to go - get the best of both worlds, GUI and config files. Splunk devs must have been in a good mood when they came up with that one!

upvoted 0 times

...

Jennie

10 days ago

Haha, option D is just too limited. Who wants to be stuck making changes only through config files or a deployment app? That sounds like a real pain. I'll go with option B, gotta have that Splunk Web flexibility!

upvoted 0 times

...

Leota

19 days ago

Option C looks good to me. I prefer working directly with the config files or a deployment app - less chance of accidentally clicking the wrong button in the UI, you know? Although I guess Splunk Web is useful for the less technical folks.

upvoted 0 times

...

Fabiola

20 days ago

Hmm, I think option B is the correct answer. Splunk Web provides a nice GUI for configuring the Universal Forwarder, but you can also make changes directly in the config files or through a deployment app. Makes sense to have multiple options, right?

upvoted 0 times

...