Use Transformations with Props.conf and Transforms.conf to Modify Raw Data CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   Which Splunk command is commonly used to test a regex pattern before applying it in a transform?

   • Aeval
   • Bregex
   • Cextract
   • Drex
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   Given the following props.conf stanza, which transform(s) will be applied to events matching this sourcetype? [apache_access] TRANSFORMS = clean, extract_ip

   • AOnly clean
   • BOnly extract_ip
   • Cclean and extract_ip, in that order
   • DNo transforms, because the syntax is invalid
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   In a transform, what does SOURCE_KEY specify?

   • AThe regular expression pattern to match
   • BWhich part of the event the REGEX operates on
   • CThe format string for the output
   • DThe destination key for the transformed value
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An admin configured a transform to extract a timestamp from raw events, but after indexing, the field is not populated. The regex works in a regex tester. What is the most likely reason the transform is not applied?

   • AThe regex is not anchored to the beginning of the event.
   • BThe transform is defined in a non-default app context.
   • CThe props.conf stanza is missing the `TRANSFORMS` attribute.
   • DThe transforms.conf stanza uses `DEST_KEY = _raw` instead of `DEST_KEY = _meta`.
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   A transform is intended to extract a value from the `_meta` field. Which setting would achieve this?

   • AREGEX = _meta
   • BDEST_KEY = _meta
   • CFORMAT = _meta
   • DSOURCE_KEY = _meta
   Reveal Solution Discussion Select an answer first