Explain How Data Transformations Are Defined and Invoked CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An admin has a sourcetype where a regex-based transformation is applied at index time. The admin needs to temporarily disable the transformation for troubleshooting without deleting the configuration. What is the best approach?

   • AChange the regex in transforms.conf to a no-op regex.
   • BRename the transformation stanza in transforms.conf.
   • CComment out the TRANSFORMS-<class> setting in props.conf for the sourcetype.
   • DDelete the transformation stanza from transforms.conf.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Splunk admin needs to mask credit card numbers in events from a payment application. The masking must happen before data is stored, so that raw events on disk never contain the full card number. Which approach should the admin use?

   • AConfigure a search-time field extraction with a regex that replaces the card number, and apply it via a saved search.
   • BDefine a transforms.conf rule with a REGEX and FORMAT, then reference it from a props.conf SEDCMD or TRANSFORMS setting for the sourcetype.
   • CUse the rex command in a search to extract the card number and the eval command to replace it, then save the results as a report.
   • DCreate a lookup table containing the card numbers and use the lookup command in a dashboard to hide them from view.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Splunk, what is the primary purpose of a data transformation?

   • ATo manage user authentication and access control for the Splunk platform
   • BTo create visualizations and dashboards from indexed events
   • CTo permanently delete raw data from the index to reduce storage costs
   • DTo change the format or content of raw data before it is indexed or during search processing
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team wants to enrich events with a field that is derived from a regex match on the raw event text. The field should be available in all searches without requiring a search-time command. Which method should the admin use?

   • AUse a lookup to add the field from an external source.
   • BUse the eval command in a saved search to create the field.
   • CDefine the regex in transforms.conf and reference it in props.conf with a TRANSFORMS-<class> setting.
   • DUse the rex command in a search to extract the field.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An admin needs to apply a regex-based transformation to a sourcetype that is ingested by multiple forwarders. The transformation must be applied consistently regardless of which forwarder sends the data. Where should the transformation be configured?

   • AOn the indexer or search head where the data is indexed, in props.conf and transforms.conf.
   • BOn the search head, in a saved search.
   • COn each forwarder, in props.conf and transforms.conf.
   • DOn the deployment server, in a server class.
   Reveal Solution Discussion Select an answer first