Syslog files are being monitored on a Heavy Forwarder. Where would the appropriate TRANSFORMS setting be deployed to reroute logs based on the event message?

The correct answer is A. Heavy Forwarder. A Heavy Forwarder is a Splunk instance that can parse and filter data before forwarding it to another Splunk instance, such as an indexer. A Heavy Forwarder can also perform index-time field extractions using the TRANSFORMS setting. The TRANSFORMS setting is used to configure dat

Splunk Forwarding

Question

Options

AHeavy Forwarder
BIndexer
CSearch head
DDeployment server

How the community answered

(38 responses)

A
87% (33)
B
3% (1)
C
3% (1)
D
8% (3)

Explanation

A Heavy Forwarder is a Splunk instance that can parse and filter data before forwarding it to another Splunk instance, such as an indexer. A Heavy Forwarder can also perform index-time field extractions using the TRANSFORMS setting. The TRANSFORMS setting is used to configure data transformations in the transforms.conf file. The transforms.conf file contains settings and values that you can use to configure host and source type overrides, anonymize sensitive data, route events to different indexes, create index- time and search-time field extractions, and set up lookup tables. The TRANSFORMS setting can be deployed to the Heavy Forwarder where the syslog files are being monitored, so that the logs can be rerouted based on the event message before they are forwarded to the indexer. This can improve the performance and efficiency of data processing

Topics

#Heavy Forwarder#Data routing#Transforms#Configuration deployment

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice