nerdexam
Cisco

300-910 · Question #45

Refer to the exhibit. The JSON object represents a single entry on a centralized log server, but log data cannot be processed because of the format. What causes the issue?

The correct answer is D. The process name in the message must be parsed into a field. The log data cannot be processed due to its format because a crucial piece of information, the process name, is embedded within the message field instead of being a distinct, structured field.

Logging and Monitoring

Question

Refer to the exhibit. The JSON object represents a single entry on a centralized log server, but log data cannot be processed because of the format. What causes the issue?

Options

  • AA hostgroup must be defined
  • BThe "_type" must represent the process type
  • CThe priority of the message must be to the server
  • DThe process name in the message must be parsed into a field

How the community answered

(65 responses)
  • A
    18% (12)
  • B
    5% (3)
  • C
    6% (4)
  • D
    71% (46)

Why each option

The log data cannot be processed due to its format because a crucial piece of information, the process name, is embedded within the message field instead of being a distinct, structured field.

AA hostgroup must be defined

A hostgroup is used for managing groups of hosts in a system, not for defining or resolving issues with the format of individual log entries.

BThe "_type" must represent the process type

While a '_type' field can categorize log entries, the problem describes a general format issue preventing processing, implying a lack of proper parsing for an existing piece of data rather than the absence of a specific '_type' field.

CThe priority of the message must be to the server

Log priority indicates the severity or importance of a message, not its destination or a cause for a log data format issue preventing processing.

DThe process name in the message must be parsed into a fieldCorrect

For log data to be effectively processed, indexed, and searched by a centralized log server, key pieces of metadata like the process name must be parsed and stored as separate, structured fields. If the process name is merely part of a free-form message string, the log system cannot easily query or filter based on this information without custom parsing rules, which indicates a format issue hindering processing.

Concept tested: Log parsing and structured logging

Source: https://www.splunk.com/en_us/data-types/structured-unstructured-data.html

Topics

#logging#log parsing#structured logging#log data processing

Community Discussion

No community discussion yet for this question.

Full 300-910 Practice