3.5 Configure Splunk to Ingest Cloud Logging and Monitoring Data from Other Security Solutions 350-701 Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   A security team is integrating a third-party IDS/IPS with Splunk. The IDS/IPS sends logs via syslog, but the logs are in a proprietary format that is not recognized by Splunk. The team wants to extract specific fields from these logs. What is the most efficient approach?

   • AUse the 'rex' command in every search to extract the fields.
   • BUse the built-in key-value extraction in props.conf.
   • CUse a lookup table to map the raw log lines to fields.
   • DWrite a custom regex in transforms.conf to extract the fields.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is integrating a third-party SIEM with Splunk. The SIEM sends logs via syslog over TCP. The logs are being received by Splunk, but the events are being truncated at 10KB. The team needs to ingest the full log events, which can be up to 64KB. What should they do?

   • AUse a heavy forwarder to parse the logs before sending them to the indexer.
   • BUse UDP instead of TCP for the syslog input.
   • CIncrease the max event size in the inputs.conf for the syslog input.
   • DConfigure the SIEM to send logs in smaller chunks.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is ingesting logs from a firewall into Splunk via syslog. The logs are being received, but the events are not being parsed correctly — the source IP is not being extracted. The team has verified that the sourcetype is correct and the regex in transforms.conf is correct. What else should they check?

   • AVerify that the syslog input is using TCP.
   • BCheck that the firewall is sending logs in the correct format.
   • CEnsure that the universal forwarder is running.
   • DEnsure that the props.conf and transforms.conf are on the indexer, not just the forwarder.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is ingesting firewall logs from multiple vendors into Splunk. Each vendor uses a different log format. They want to normalize the logs so that the field 'src_ip' is consistent across all sources. What is the best approach?

   • AUse a search-time field alias to map each vendor's source IP field to a common field name.
   • BUse the 'rename' command in every search to change the field names.
   • CConfigure the inputs to use a universal forwarder to parse the logs.
   • DCreate a separate index for each vendor and use a different sourcetype.
   Reveal Solution Discussion Select an answer first