Use Optional Settings for Monitor Inputs CLOUD-CERTIFIED-ADMIN Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following methods can be used to set the host value for a monitor input?

   • AUse the DNS name of the forwarder
   • BUse the file name of the monitored file
   • CAssign a static host value
   • DUse the IP address of the data source
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the purpose of a whitelist filter in a monitor input?

   • ATo exclude files that match the specified pattern
   • BTo include only files that match the specified pattern
   • CTo set the source type for the monitored files
   • DTo specify the index for the monitored files
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What happens when a monitored file's CRC value changes?

   • ASplunk re-reads the file from the beginning
   • BSplunk stops monitoring the file
   • CSplunk creates a new index for the file
   • DSplunk ignores the file
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A Splunk admin is configuring a monitor input for a directory that contains both active log files and old archived files that have not been modified in months. The admin wants to skip the old archived files to save resources. Which setting should be used?

   • ASet `followTail = true` in the monitor input.
   • BSet `ignoreOlderThan = 30d` in the monitor input.
   • CSet `time_before_close = 86400` in the monitor input.
   • DSet `whitelist = *.log` in the monitor input.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization has separate Splunk indexes for different business units: `sales`, `marketing`, and `engineering`. A monitor input is being configured to read logs from a shared application server that generates logs for all three units. The admin needs to ensure that logs from the `/var/log/sales/` directory are sent to the `sales` index. What should the admin do?

   • ASet the `sourcetype` to `sales` and rely on props.conf to route to the index.
   • BSet `index = sales` in the existing monitor input that covers all directories.
   • CUse a `blacklist` to exclude non-sales logs and set `index = sales`.
   • DCreate a separate monitor input for `/var/log/sales/` and set `index = sales` in that input.
   Reveal Solution Discussion Select an answer first