Which of the following is an example of a data transformation in Splunk?

Using a regular expression to extract a new field from raw event data

Configuring a distributed search head to forward results to a cluster

Assigning a user role to a new Splunk account

Creating a saved search that runs on a schedule

An admin is managing a Splunk Cloud deployment and needs to apply a regex-based transformation to a sourcetype. The admin has defined the transformation in transforms.conf. What is the correct way to invoke it in Splunk Cloud?

Submit a support ticket to Splunk to have the transformation applied.

Reference the transformation in props.conf with a TRANSFORMS- setting for the sourcetype.

Use the field extraction wizard in Splunk Web to create the transformation.

Use a saved search with the rex command to apply the transformation.

At which point can a data transformation be invoked in Splunk?

At report generation time, when a dashboard is rendered

Only at index time, before data is stored

Only at search time, when a query is executed

At both index time and search time

A Splunk admin needs to add a new field to events at index time. The field value should be derived from a portion of the raw event text. Which configuration should be used?

Define a regex in transforms.conf and reference it in props.conf with a TRANSFORMS- setting.

Use the rex command in a search to extract the field.

Use the eval command in a saved search to create the field.

Use the field extraction wizard in Splunk Web to create the field.

A team wants to anonymize IP addresses in events before they are stored in Splunk. The admin needs to ensure that the raw data on disk does not contain the original IP addresses. Which approach should be used?

Use the eval command with the replace() function in a saved search.

Use an index-time transformation defined in transforms.conf and invoked via a TRANSFORMS- setting in props.conf.

Use a lookup to map IP addresses to anonymized values in a dashboard.

Use the rex command in a search to replace the IP addresses in the results.

SplunkCloud Certified Admin

Domain 11Objective 1

Explain How Data Transformations Are Defined and Invoked CLOUD-CERTIFIED-ADMIN Practice Questions (Page 2)

Part of the Manipulating Raw Data domain, which accounts for 10% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

2concepts

10%of the exam

Questions 6–10

6foundation · easy
Which of the following is an example of a data transformation in Splunk?
Select an answer first
7expert · hard
An admin is managing a Splunk Cloud deployment and needs to apply a regex-based transformation to a sourcetype. The admin has defined the transformation in transforms.conf. What is the correct way to invoke it in Splunk Cloud?
Select an answer first
8foundation · easy
At which point can a data transformation be invoked in Splunk?
Select an answer first
9application · medium
A Splunk admin needs to add a new field to events at index time. The field value should be derived from a portion of the raw event text. Which configuration should be used?
Select an answer first
10application · medium
A team wants to anonymize IP addresses in events before they are stored in Splunk. The admin needs to ensure that the raw data on disk does not contain the original IP addresses. Which approach should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.