Explain How Data Transformations Are Defined and Invoked SPLK-1003 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   If a props.conf stanza has `TRANSFORMS-set1 = t1, t2, t3`, in what order will the transformations run?

   • At3, then t2, then t1
   • BAll at the same time
   • CIn alphabetical order: t1, t2, t3
   • Dt1, then t2, then t3
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Splunk admin wants to use a lookup transformation to add a field to incoming events. The admin has created the lookup file and defined the transform in transforms.conf. What else is required to make the lookup work?

   • AAdd a TRANSFORMS-<class> attribute in props.conf for the sourcetype.
   • BRestart Splunk and the lookup will automatically apply to all sourcetypes.
   • CAdd the lookup file to the Splunk installation directory.
   • DCreate a saved search that runs the lookup on existing events.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Splunk admin needs to remove a prefix from a field value in incoming events. For example, change 'USER:alice' to 'alice'. Which type of transformation is best suited for this task?

   • AA regex transformation that captures the part after the prefix and writes it to the same field.
   • BA lookup transformation that maps the full value to the shortened value.
   • CAn eval transformation that uses the `replace` function.
   • DA field extraction in props.conf that only extracts the part after the prefix.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Splunk admin wants to use a regex transformation to extract a session ID from incoming events. The admin has created the transform in transforms.conf. What else must be done to ensure the transformation is applied to the correct sourcetype?

   • ARestart Splunk and the transform will automatically apply to all sourcetypes.
   • BCreate a saved search that applies the transform to events of that sourcetype.
   • CAdd a stanza in props.conf for the sourcetype with a TRANSFORMS-<class> attribute referencing the transform.
   • DAdd the sourcetype to the transform stanza in transforms.conf.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How are data transformations invoked during the parsing process in Splunk?

   • AThey are triggered by search commands at query time
   • BThey are called directly from inputs.conf for each data input
   • CThey are referenced by props.conf stanzas that apply to specific source types
   • DThey are executed automatically on all data without any configuration
   Reveal Solution Discussion Select an answer first