splk-1005 Practice Test

splk-1005 Practice Test practice questions, page 3 of 3, with answer review and explanations.

Question 11

A monitor has been created in inputs.conf for a directory that contains a mix of file types. How would a Cloud Admin fine-tune assigned sourcetypes for different files in the directory during the input phase?

  1. On the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.
  2. On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.
  3. On the Indexer parsing the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props.conf that filters out unwanted files.
  4. On the forwarder collecting the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props.conf that filters out unwanted files.

Question 12

Windows input types are collected in Splunk via a script which is configurable using the GUI. What is this type of input called?

  1. Batch
  2. Scripted
  3. Modular
  4. Front-end