Use Optional Settings for Monitor Inputs CLOUD-CERTIFIED-ADMIN Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the purpose of the 'time before a file is considered complete' setting for a monitor input?

   • ATo set the interval at which the file is checked for changes
   • BTo determine the source type of the data
   • CTo specify the maximum age of events in the file
   • DTo determine when Splunk stops monitoring a file for new data
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In Splunk Web, where can you specify the index for a monitor input?

   • AIn the Settings > Indexes page
   • BIn the Input Settings section of the Add Data page
   • CIn the Search bar using the index= command
   • DIn the Settings > Data Inputs page
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is NOT an optional setting for a monitor input in Splunk?

   • AIndex
   • BSourcetype
   • CHost
   • DSearch time range
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which stanza in props.conf is used to override settings for a specific monitor input?

   • A[monitor:///path/to/file]
   • B[default]
   • C[source::/path/to/file]
   • D[host::hostname]
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A Splunk admin is configuring a monitor input for log files that are generated by a legacy application. The files are encoded in UTF-16, but Splunk's default character set is UTF-8. The admin notices that the events are being indexed with garbled characters. What should the admin configure to fix this issue?

   • ASet `charset = UTF-16` in the monitor input's inputs.conf stanza.
   • BSet `host = UTF-16` in the monitor input.
   • CSet `sourcetype = UTF-16` in the monitor input.
   • DSet `maxEventSize = 256` in the monitor input.
   Reveal Solution Discussion Select an answer first