Splunk
SPLK-1003 · Question #103
A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data 45 days old and newer from that log file?
The correct answer is D. ignoreOlderThan = 45d. https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Configuretimestamprecognition
Configuration Files
Question
A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data 45 days old and newer from that log file?
Options
- AfollowTail = -45d
- Bignore = 45d
- CincludeNewerThan = -35d
- DignoreOlderThan = 45d
How the community answered
(60 responses)- A7% (4)
- B2% (1)
- C2% (1)
- D90% (54)
Explanation
https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Configuretimestamprecognition
Topics
#inputs.conf#Data Onboarding#Timestamp Filtering#Monitor Stanza
Community Discussion
No community discussion yet for this question.