A security team needs to ingest a static file for a specific incident. The log file has not been collected previously and future updates to the file must not be indexed. Which command would meet these

The correct answer is A. splunk add one shot / opt/ incident [data .log --index incident. The correct answer is A. splunk add one shot / opt/ incident [data . log --index incident According to the Splunk documentation1, the splunk add one shot command adds a single file or directory to the Splunk index and then stops monitoring it. This is useful for ingesting static

Splunk Indexing

Question

A security team needs to ingest a static file for a specific incident. The log file has not been collected previously and future updates to the file must not be indexed. Which command would meet these needs?

Options

Asplunk add one shot / opt/ incident [data .log --index incident
Bsplunk edit monitor /opt/incident/data.* --index incident
Csplunk add monitor /opt/incident/data.log --index incident
Dsplunk edit oneshot [opt/ incident/data.* --index incident

How the community answered

(26 responses)

A
88% (23)
C
4% (1)
D
8% (2)

Explanation

The correct answer is A. splunk add one shot / opt/ incident [data . log --index incident According to the Splunk documentation1, the splunk add one shot command adds a single file or directory to the Splunk index and then stops monitoring it. This is useful for ingesting static files that do not change or update. The command takes the following syntax: splunk add one shot <file> -index <index_name> The file parameter specifies the path to the file or directory to be indexed. The index parameter specifies the name of the index where the data will be stored. If the index does not exist, Splunk will create it automatically.

Topics

#data ingestion#CLI commands#oneshot input#input configuration

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice