Free Preparation Discussions
MENU
Splunk SPLK-1003 Exam - Topic 15 Question 102 Discussion
Topic #: 15
How is a remote monitor input distributed to forwarders?
The correct answer is B. in props.conf:
[identity]
SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
s/password=([^,|/s]+)/ ####REACTED####/g
The g flag at the end means that the replacement is applied globally, not just to the first match.
Option A is incorrect because it uses the REGEX attribute instead of the SEDCMD attribute. The REGEX attribute is used to extract fields from events, not to modify them.
Option C is incorrect because it uses the transforms.conf file instead of the props.conf file. The transforms.conf file is used to define transformations that can be applied to fields or events, such as lookups, evaluations, or replacements. However, these transformations are applied after indexing, not before.
Option D is incorrect because it uses both the wrong attribute and the wrong file. There is no REGEX-redact_pw attribute in the transforms.conf file.
Adell
4 months agoDarrin
4 months agoRessie
4 months agoDenny
4 months agoLouis
5 months agoLeah
5 months agoIvan
5 months agoJohnson
5 months agoArletta
5 months agoDyan
5 months agoCraig
5 months agoMable
5 months agoLavera
5 months agoGladys
6 months agoWalton
10 months agoBritt
10 months agoShaniqua
10 months agoAngella
9 months agoDolores
9 months agoNana
10 months agoJospeh
11 months agoNieves
9 months agoLucy
10 months agoBrock
10 months agoJohnetta
11 months agoChana
9 months agoJamie
9 months agoIra
10 months agoEloisa
10 months agoGeorgeanna
11 months agoMiesha
11 months agoJesus
12 months ago