Splunk Exam SPLK-1005 Topic 3 Question 1 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 1
Topic #: 3

A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?

Aprops. conf on a Splunk Cloud search head,

Bprops.conf on a Heavy Forwarder.

Ctransforms, cent on a Splunk Cloud indexer.

Dprops. conf- on a Universal Forwarder.

Show Suggested Answer

Suggested Answer: B

To mask unstructured data before sending it to Splunk Cloud, the SEDCMD should be configured in the props.conf file on a Heavy Forwarder. The Heavy Forwarder is responsible for data parsing and transformation before forwarding the data to Splunk Cloud. This ensures that sensitive data is masked before it reaches the indexing stage.

Splunk Documentation Reference: Using SEDCMD to Mask Data

by Dan at Oct 19, 2024, 11:46 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Romana

2 days ago

I agree with Virgie, because Heavy Forwarders are responsible for data routing and transformation before sending it to the indexer.

upvoted 0 times

...

Virgie

5 days ago

I think SEBCMD should be configured in props.conf on a Heavy Forwarder.

upvoted 0 times

...