A Splunk admin is configuring a monitor input for a log file that is generated by a legacy application. The application does not include a hostname in the log events. The admin wants all events from this file to be associated with the hostname 'legacy-app-01'. Which setting should be used in the monitor input configuration?

Set index = legacy-app-01 in the monitor input stanza.

Set host = legacy-app-01 in the monitor input stanza.

Set host_segment = 1 in the monitor input stanza.

Set host_regex = legacy-app-01 in the monitor input stanza.

What is the purpose of a checkpoint in Splunk monitoring?

To verify that the file has not been modified by an unauthorized user

To delete old events from the index

To compress the file to save disk space

To record the position in a file so Splunk does not re-index data after a restart

In a directory monitor input, what is the purpose of the 'whitelist' setting?

To specify which files in the directory should be monitored

To set the permissions for files that Splunk can read

To define the source type for all files in the directory

To exclude certain files from being monitored

What is the effect of setting 'host = webserver01' in a monitor input?

It sends the data to an index named 'webserver01'

It restricts monitoring to only the file named 'webserver01'

It assigns the host value 'webserver01' to all events from that input

It changes the source type of the events to 'webserver01'

Which Splunk command or view is useful for verifying that a monitor input is actually reading data?

The Settings > Data Inputs page

The Data Summary page in Splunk Web

The Monitoring Console's Inputs page

The Search page with a search for 'index=_internal'

SplunkCloud Certified Admin

Domain 7Objective 2

Create File and Directory Monitor Inputs CLOUD-CERTIFIED-ADMIN Practice Questions (Page 2)

Part of the Monitor Inputs domain, which accounts for 15% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

7concepts

15%of the exam

Questions 6–10

6application · medium
A Splunk admin is configuring a monitor input for a log file that is generated by a legacy application. The application does not include a hostname in the log events. The admin wants all events from this file to be associated with the hostname 'legacy-app-01'. Which setting should be used in the monitor input configuration?
Select an answer first
7foundation · easy
What is the purpose of a checkpoint in Splunk monitoring?
Select an answer first
8foundation · easy
In a directory monitor input, what is the purpose of the 'whitelist' setting?
Select an answer first
9foundation · easy
What is the effect of setting 'host = webserver01' in a monitor input?
Select an answer first
10foundation · easy
Which Splunk command or view is useful for verifying that a monitor input is actually reading data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.