Splunk SPLK-3003 Exam - Topic 6 Question 28 Discussion

Actual exam question for Splunk's SPLK-3003 exam

Question #: 28
Topic #: 6

A customer would like Splunk to delete files after they've been ingested. The Universal Forwarder has read/ write access to the directory structure. Which input type would be most appropriate to use in order to ensure files are ingested and then deleted afterwards?

AScript

BBatch

CMonitor

DFschange

Show Suggested Answer

Suggested Answer: B

by Glendora at May 07, 2022, 07:15 PM

Limited Time Offer

25%

Off

Get Premium SPLK-3003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Beckie

5 months ago

Not convinced Batch is the best choice here.

upvoted 0 times

...

Luisa

5 months ago

Definitely Batch! It handles file deletion perfectly.

upvoted 0 times

...

Ronny

6 months ago

Wait, can we really delete files automatically after ingestion?

upvoted 0 times

...

Bettye

6 months ago

I think Monitor would work too, but not sure about deletion.

upvoted 0 times

...

Refugia

6 months ago

Batch is the way to go for this!

upvoted 0 times

...

Erick

6 months ago

I’m confused about Fschange; I don’t recall it being used for deleting files after ingestion. Could it be a trick option?

upvoted 0 times

...

Luke

6 months ago

I’m leaning towards the Script option, but I feel like it might not be the best fit for this scenario.

upvoted 0 times

...

Mabel

6 months ago

I remember practicing a similar question, and I think Monitor is more for ongoing file monitoring rather than deleting after ingestion.

upvoted 0 times

...

Franklyn

6 months ago

I think the Batch input type might be the right choice since it can handle files and delete them after processing, but I'm not entirely sure.

upvoted 0 times

...

Dong

6 months ago

Okay, I think I've got it. The merge code needs to reference the output of the HTTP Action, which is labeled as CaseData, and then pass that to the input of the DataRaptor Transform Action. I'll go with option B.

upvoted 0 times

...

Teddy

6 months ago

Hmm, narrowing the scope of the first phase - that's an interesting approach. I'll need to consider which options would be the most strategic and practical.

upvoted 0 times

...