A Splunk admin needs to mask credit card numbers in incoming web logs before they are indexed. The admin has created a transforms.conf stanza that uses a REGEX to identify the card number and a FORMAT to replace it. What additional configuration is required to invoke this transformation?

Use the transform in a search-time field extraction and restart the search head.

Add the transform name to the [default] stanza in transforms.conf and run a reload.

Add a transforms stanza reference in props.conf for the sourcetype, and restart Splunk.

Create a saved search that applies the transform to existing events.

What is the correct stanza format for defining a data transformation in transforms.conf?

[default] followed by a list of all transformations

[source:: ] followed by transformation settings

[ ] followed by transformation settings

A Splunk admin needs to add a new field to incoming events that indicates the geographic region based on the client's IP address. The admin has a CSV file mapping IP ranges to regions. Which type of transformation should be used?

A field extraction in props.conf using a regular expression.

A lookup transformation defined in transforms.conf and referenced in props.conf.

An eval transformation that uses the `if` function to assign the region.

A regex transformation that extracts the region from the IP address.

SplunkEnterprise Certified Admin

Domain 5Objective 5

Explain How Data Transformations Are Defined and Invoked SPLK-1003 Practice Questions (Page 3)

Part of the Parsing and Data Manipulation domain, which makes up ~29% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 14 practice questions to prepare you well beyond it. (estimate)

14questions here

3free pages

5concepts

Questions 11–14

11application · medium
A Splunk admin needs to mask credit card numbers in incoming web logs before they are indexed. The admin has created a transforms.conf stanza that uses a REGEX to identify the card number and a FORMAT to replace it. What additional configuration is required to invoke this transformation?
Select an answer first
12foundation · easy
Which transformation type uses a CSV file to add fields to events?
Select an answer first
13foundation · easy
What is the correct stanza format for defining a data transformation in transforms.conf?
Select an answer first
14application · medium
A Splunk admin needs to add a new field to incoming events that indicates the geographic region based on the client's IP address. The admin has a CSV file mapping IP ranges to regions. Which type of transformation should be used?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-1003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1003” is a trademark of its owner, used for identification only.

Explain How Data Transformations Are Defined and Invoked SPLK-1003 Practice Questions (Page 3)

Questions 11–14

A Splunk admin needs to mask credit card numbers in incoming web logs before they are indexed. The admin has created a transforms.conf stanza that uses a REGEX to identify the card number and a FORMAT to replace it. What additional configuration is required to invoke this transformation?

Which transformation type uses a CSV file to add fields to events?

What is the correct stanza format for defining a data transformation in transforms.conf?

A Splunk admin needs to add a new field to incoming events that indicates the geographic region based on the client's IP address. The admin has a CSV file mapping IP ranges to regions. Which type of transformation should be used?

Keep studying — Parsing and Data Manipulation