MENU
Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?
Suggested Answer: B
Get Premium SPLK-1005 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.
Splunk Documentation Reference: props.conf configuration
30 comments · newest first
KA
Kati
10 months ago
C sounds right, but I prefer using the UI for changes.
BA
Barrett
11 months ago
D is misleading, you can use Splunk Web too.
PH
Phung
11 months ago
Wait, I thought it had to be done in the UI only?
CL
Claribel
11 months ago
Totally agree, B covers all bases!
BE
Belen
11 months ago
B is correct, you can use multiple methods.
KA
Katy
12 months ago
I recall that using a deployment app is a common method, but I can't remember if it excludes the Splunk Web interface.
LA
Latrice
12 months ago
I’m a bit confused about whether changes can only be made in configuration files or if Splunk Web is also an option.
ED
Edgar
12 months ago
I practiced a similar question where we had to identify configuration methods, and I feel like option B is the most comprehensive one.
ME
Melissa
1 year ago
I think I remember that you can configure the Universal Forwarder using different methods, but I'm not sure if it includes Splunk Web.
CA
Carline
1 year ago
Okay, let me think this through. I know the Splunk Web interface has some configuration options, but I'm not sure if that's the only way to do it. I'll review the other choices carefully and see if I can eliminate any of the options.
ET
Ettie
1 year ago
Ah, I remember learning about this in class. I'm pretty confident the answer is B - the configuration changes can be made using Splunk Web, the command-line interface, or a deployment app. I'll double-check the details, but I think I've got this one.
ME
Mel
1 year ago
Hmm, I'm a bit unsure about this one. I know there are a few ways to configure a Universal Forwarder, but I'm not totally clear on the specifics for an Intermediate Forwarder. I'll have to think it through step-by-step.
ER
Ernest
1 year ago
This looks like a straightforward configuration question. I'll review the options carefully and think through the different ways to configure a Universal Forwarder as an Intermediate Forwarder.
RE
Renea
1 year ago
Hmm, this question is making me hungry. I wonder if there's a 'Universal Forwarder Sandwich' on the menu today? Anyway, I'm gonna go with option C - can't go wrong with the classic config file approach. Less chance of accidentally clicking the wrong button and ending up with a 'Universal Disaster' on my hands!
GE
Genevive
1 year ago
I prefer option D. Directly editing configuration files gives me more control over the process.
DO
Dottie
1 year ago
I think I'll go with option B. Splunk Web is user-friendly and convenient for making changes.
VI
Virgina
1 year ago
I agree, option C seems like the safest choice. Config files are the way to go.
DA
Dalene
1 year ago
Ooh, option A sounds a bit too restrictive. I mean, come on, Splunk is all about flexibility, right? Option B is the way to go - get the best of both worlds, GUI and config files. Splunk devs must have been in a good mood when they came up with that one!
JE
Jennie
1 year ago
Haha, option D is just too limited. Who wants to be stuck making changes only through config files or a deployment app? That sounds like a real pain. I'll go with option B, gotta have that Splunk Web flexibility!
EA
Earnestine
1 year ago
Staci: Definitely, having the ability to make changes through Splunk Web is much more convenient.
DE
Delbert
1 year ago
User 3: I think option B is the way to go as well.
ST
Staci
1 year ago
User 2: Yeah, I prefer option B for the flexibility it offers.
AN
Annmarie
1 year ago
User 1: I agree, option D does seem too limited.
LE
Leota
1 year ago
Option C looks good to me. I prefer working directly with the config files or a deployment app - less chance of accidentally clicking the wrong button in the UI, you know? Although I guess Splunk Web is useful for the less technical folks.
NE
Nenita
1 year ago
User 2: I agree, less room for error that way. Splunk Web can be handy, but I prefer the control of config files.
FR
Frankie
1 year ago
User 1: Option C is definitely the way to go. Directly in config files or via a deployment app is the safest bet.
FA
Fabiola
2 years ago
Hmm, I think option B is the correct answer. Splunk Web provides a nice GUI for configuring the Universal Forwarder, but you can also make changes directly in the config files or through a deployment app. Makes sense to have multiple options, right?
LO
Lovetta
2 years ago
Why do you think C is correct?
JU
Junita
2 years ago
I disagree, I believe the correct answer is C.
LO
Lovetta
2 years ago
I think the answer is B.