Inputs Overview SPLK-1003 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Splunk admin is configuring a new input for firewall logs. The logs have a timestamp format that Splunk does not recognize by default. The admin has created a custom sourcetype called 'firewall_logs' in inputs.conf. What should the admin do next to ensure the timestamp is parsed correctly?

   • AAdd a transforms.conf stanza for 'firewall_logs' with the correct TIME_FORMAT.
   • BAdd a props.conf stanza for 'firewall_logs' with the correct TIME_FORMAT.
   • CUse the default sourcetype and rely on automatic timestamp detection.
   • DSet the TIME_FORMAT in the input stanza of inputs.conf.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Splunk admin is setting up an input to monitor a directory where multiple applications write log files. Each application writes to a different subdirectory, and the admin wants to ensure that events from each application are tagged with the correct host. The logs are in a standard format that Splunk recognizes. What should the admin configure in the input stanza?

   • ASet the index to the application name for each subdirectory input.
   • BSet the source to the application name for each subdirectory input.
   • CSet the sourcetype to the application name for each subdirectory input.
   • DSet the host to the application name for each subdirectory input.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A Splunk admin is ingesting logs from a custom application that writes events in a format where multiple lines form a single event. The default line-breaking is splitting these events incorrectly. The admin has created a custom sourcetype and needs to configure the parsing to treat the multi-line events as single events. What should the admin configure in props.conf?

   • ASet MAX_EVENTS to a large number to capture multi-line events.
   • BSet LINE_BREAKER to a regex that matches the end of each event.
   • CSet SHOULD_LINEMERGE to false to prevent line merging.
   • DSet TIME_FORMAT to a pattern that includes the newline character.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Splunk admin needs to ingest data from a network device that sends logs via syslog. The device does not support any other protocol. The admin wants to ensure that the logs are received and tagged with the device's hostname. What should the admin configure?

   • AConfigure a scripted input that reads the syslog data and sets the host.
   • BConfigure a UDP input on port 514 and set the host to the device's hostname.
   • CConfigure a TCP input on port 514 and set the source to the device's hostname.
   • DConfigure an HEC token and set the host to the device's hostname.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which Splunk input option is used to collect data from a TCP or UDP port?

   • AHTTP Event Collector
   • BNetwork input
   • CScripted input
   • DFile input
   Reveal Solution Discussion Select an answer first