Explain How Data Transformations Are Defined and Invoked CLOUD-CERTIFIED-ADMIN Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   An admin is configuring a new data input. The admin wants to remove a specific string from every event of this sourcetype before it is indexed. Which configuration should be used?

   • AUse the eval command with the replace() function in a search.
   • BUse the replace command in a saved search.
   • CAdd a SEDCMD-<class> setting in props.conf for the sourcetype.
   • DAdd a TRANSFORMS-<class> setting in props.conf and define a regex in transforms.conf.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An admin is configuring a new sourcetype and wants to apply a regex-based transformation to extract a field. The admin has defined the transformation in transforms.conf. What additional step is required to invoke the transformation?

   • AAdd a TRANSFORMS-<class> setting in props.conf for the sourcetype that references the transformation name.
   • BCreate a saved search that uses the rex command with the transformation name.
   • CRestart Splunk and the transformation will be automatically applied to all sourcetypes.
   • DAdd the transformation name to the [default] stanza in transforms.conf.
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   A team wants to add a new field to events at search time without modifying the raw data. The field should be derived from an existing field using a regex. Which method should the admin use?

   • AUse the rex command in a search to extract the new field from the existing field.
   • BConfigure a lookup definition in transforms.conf and use it in a search.
   • CCreate a transforms.conf entry and reference it in props.conf with a TRANSFORMS-<class> setting.
   • DUse the SEDCMD attribute in props.conf to replace the existing field value.
   Reveal Solution Discussion Select an answer first