Optimize and Configure Event Line Breaking SPLK-1003 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which props.conf setting defines a regular expression that Splunk uses to identify event boundaries?

   • ALINE_BREAKER
   • BMAX_TIMESTAMP_LOOKAHEAD
   • CSHOULD_LINEMERGE
   • DBREAK_ONLY_BEFORE
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A log file contains events that are separated by a blank line. Each event consists of multiple lines. You need to configure props.conf so that each block of lines separated by a blank line is indexed as a single event. Which settings should you use?

   • ABREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}
   • BSHOULD_LINEMERGE = false and LINE_BREAKER = ([\r\n]+)
   • CLINE_BREAKER = ([\r\n]+\s*[\r\n]+)
   • DSHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE = ^\s*$
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A high-volume data source currently uses a complex LINE_BREAKER regex with multiple alternations and lookarounds. Indexing performance has degraded. Which change is most likely to improve line breaking performance?

   • AEnable SHOULD_LINEMERGE = true to reduce the number of events.
   • BUse a BREAK_ONLY_BEFORE regex instead of LINE_BREAKER.
   • CIncrease the number of parsing queues in indexes.conf.
   • DSimplify the LINE_BREAKER regex to use a more efficient pattern, such as a single character class.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a LINE_BREAKER regex, what does the capturing group represent?

   • AThe first line of each event
   • BThe timestamp of the event
   • CThe text that is discarded between events
   • DThe host field for the event
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are optimizing line breaking for a data source that has very large events (megabytes in size). The current LINE_BREAKER uses a complex regex with many lookaheads. What is the best practice to improve performance?

   • AUse BREAK_ONLY_BEFORE instead of LINE_BREAKER.
   • BUse a simpler regex that matches a fixed string delimiter.
   • CDisable line merging to reduce processing.
   • DIncrease the max_event_size setting in props.conf.
   Reveal Solution Discussion Select an answer first