nerdexam
SplunkSplunk

SPLK-1003 · Question #156

SPLK-1003 Question #156: Real Exam Question with Answer & Explanation

Sign in or unlock SPLK-1003 to reveal the answer and full explanation for question #156. The question stem and answer options stay visible for context.

Splunk Forwarding

Question

A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Both sets of data require the masking of raw text strings before being written to disk. What does the administrator need to do to ensure that the masking takes place successfully?

Options

  • AMake sure that props . conf and transforms . conf are both present on the in-dexer and the search
  • BFor source A, make sure that props . conf is in place on the indexer; and for source B, make sure
  • CMake sure that props . conf and transforms . conf are both present on the Universal Forwarder.
  • DPlace both props . conf and transforms . conf on the Heavy Forwarder for source A, and place

Unlock SPLK-1003 to see the answer

You've previewed enough free SPLK-1003 questions. Unlock SPLK-1003 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Topics

#Data Masking#Heavy Forwarder#Indexer#Data Transformation
Full SPLK-1003 PracticeBrowse All SPLK-1003 Questions