SPLK-1003 Practice Test

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678. Which configuration file and stanza pair will mask possible SSNs in the log events?

A. props.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1###-##-$2
KEY = _raw

B. props.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1###-##-$2
DEST_KEY = _raw

C. transforms.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1###-##-$2
DEST_KEY = _raw

D. transforms.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1###-##-$2
DEST_KEY = _raw

After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

A. index=main

B. index=test

C. index=summary

D. index=_internal

What hardware attribute would need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

A. Disk

B. CPUs

C. Memory

D. Network interface cards

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

A. App Class

B. Client Class

C. Server Class

D. Forwarder Class

Load balancing on a Universal Forwarder is not scaling correctly. The forwarder's outputs. and the tcpout stanza are setup correctly. What else could be the cause of this scaling issue? (select all that apply)

A. The receiving port is not properly setup to listen on the right port.

B. The inputs . conf'S _SYSZOG_ROVTING is not setup to use the right group names.

C. The DNS record used is not setup with a valid list of IP addresses.

D. The indexAndForward value is not set properly.