Explain How Data Transformations Are Defined and Invoked CLOUD-CERTIFIED-ADMIN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How is a data transformation typically invoked at index time in Splunk?

   • ABy using the rex command in a search query
   • BBy enabling the 'index-time transformation' checkbox in the Splunk Web interface
   • CBy writing a custom Python script and placing it in the bin directory
   • DBy defining it in transforms.conf and referencing it from props.conf
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An admin wants to mask a sensitive pattern in events from a specific sourcetype. The masking should be applied only to new data being indexed, not to historical data. Which approach should be used?

   • AUse a lookup to mask the pattern in a dashboard.
   • BUse the rex command in a search to mask the pattern in results.
   • CUse the eval command with the replace() function in a saved search.
   • DConfigure an index-time transformation in transforms.conf and reference it in props.conf for the sourcetype.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team wants to extract a field from raw events at index time so that the field is available in all searches. The admin has defined the regex in transforms.conf. What is the next step to invoke the transformation?

   • ACreate a saved search that uses the rex command with the transformation name.
   • BRestart Splunk and the transformation will be automatically applied to all sourcetypes.
   • CAdd the transformation name to the [default] stanza in transforms.conf.
   • DAdd a TRANSFORMS-<class> setting in props.conf for the sourcetype that references the transformation name.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An admin is configuring a transformation to extract a field from raw events. The admin wants the field to be available in all searches without requiring a search-time command. However, the admin also wants to be able to test the regex before applying it to production data. What is the best approach?

   • ADefine the regex in transforms.conf and reference it in props.conf, then test it on production data.
   • BTest the regex with the rex command in a search, then define it in transforms.conf and reference it in props.conf.
   • CUse the field extraction wizard to create the extraction and then convert it to an index-time transformation.
   • DUse the eval command with a regex function to test the extraction, then define it in transforms.conf.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An admin is troubleshooting why a regex-based transformation defined in transforms.conf is not being applied to a specific sourcetype. The admin has already confirmed that the regex works in a search. What is the most likely reason the transformation is not being invoked?

   • AThe regex is too complex for index-time processing.
   • BThe transformation is defined in the wrong stanza of transforms.conf.
   • CThe admin needs to restart Splunk for the transformation to take effect.
   • DThe props.conf file does not have a TRANSFORMS-<class> setting that references the transformation for that sourcetype.
   Reveal Solution Discussion Select an answer first