Use Optional Settings for Monitor Inputs CLOUD-CERTIFIED-ADMIN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of the 'ignoreOlderThan' setting for a monitor input?

   • ATo specify the character encoding of the file
   • BTo skip files that have not been modified within a specified time
   • CTo determine the source type of the data
   • DTo set the maximum size of a single event
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Splunk admin is monitoring a directory that contains hundreds of log files. The admin notices that indexing is slow and wants to improve performance by increasing the number of threads used to read files. Which setting should the admin configure?

   • ASet `followTail = true` in the monitor input.
   • BSet `threads = 8` in the monitor input.
   • CSet `maxEventSize = 1000000` in the monitor input.
   • DSet `readTimeout = 30` in the monitor input.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A Splunk admin is monitoring a directory where a legacy application rotates logs by renaming the current file to `app.log.1` and creating a new `app.log`. The admin notices that after rotation, Splunk sometimes indexes the renamed file again, causing duplicate events. The admin wants to prevent this duplication while ensuring the new `app.log` is indexed. Which approach should the admin take?

   • ASet `followTail = true` in the monitor input.
   • BAdd `app.log.1` to the `blacklist` in the monitor input.
   • CSet `crcSalt = <random_string>` in the monitor input.
   • DSet `time_before_close = 0` in the monitor input.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of the read timeout setting for a monitor input?

   • ATo manage slow or stalled file reads
   • BTo set the maximum size of a single event
   • CTo determine the source type of the data
   • DTo specify the character encoding of the file
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's web server writes access logs in a custom format that includes a timestamp, IP address, and request path. The Splunk admin is configuring a monitor input for these logs and needs to ensure the data is parsed correctly. The admin has already created a custom sourcetype called `web_access` in props.conf. What is the correct way to apply this sourcetype to the monitor input?

   • ACreate a new monitor input for each log file and set the sourcetype in props.conf only.
   • BSet the `index` attribute in inputs.conf to `web_access`.
   • CUse the `host` setting in inputs.conf to define the sourcetype.
   • DSet the `sourcetype` attribute in inputs.conf to `web_access`.
   Reveal Solution Discussion Select an answer first