Use SEDCMD to Modify Raw Data CLOUD-CERTIFIED-ADMIN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which regular expression would match a date in the format YYYY-MM-DD?

   • A\d{4}-\d{2}-\d{2}
   • B\w{4}-\w{2}-\w{2}
   • C[0-9]+-[0-9]+-[0-9]+
   • D\d{2}-\d{2}-\d{4}
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A Splunk admin needs to modify raw data at index time by replacing a specific string in every event of a sourcetype. The replacement must happen before the data is parsed and indexed. Which method should the admin use?

   • AUse a REGEX transform in transforms.conf.
   • BConfigure a SEDCMD in props.conf for the sourcetype.
   • CApply an EVAL expression in a search-time field extraction.
   • DUse the rex command in a search.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which SEDCMD expression would replace every occurrence of 'error' with 'warning' in an event?

   • As/error/warning/i
   • Bs/error/warning/g
   • Cs/error/warning/
   • Dy/error/warning/
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a key difference between SEDCMD and EVAL?

   • ASEDCMD is used for field extraction, while EVAL is used for raw data modification
   • BSEDCMD operates at index time, while EVAL operates at search time
   • CSEDCMD is a search command, while EVAL is a configuration setting
   • DBoth operate at index time, but EVAL is more powerful
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does SEDCMD differ from REGEX in Splunk?

   • ASEDCMD modifies raw data, while REGEX extracts fields
   • BSEDCMD is a search command, while REGEX is a configuration setting
   • CSEDCMD is used for field extraction, while REGEX modifies raw data
   • DSEDCMD runs at search time, while REGEX runs at index time
   Reveal Solution Discussion Select an answer first