Windows can prevent a Splunk forwarder from reading open files. If files need to be read while they are being written to, what type of input stanza needs to be created?

The correct answer is C. MonitorNoHandIe. MonitorNoHandle is a type of input stanza that allows a Splunk forwarder to read files on Windows systems as Windows writes to them. It does this by using a kernel-mode filter driver to capture raw data as it gets written to the file. This input stanza is useful for files that ge

Splunk Forwarding

Question

Options

ATail Reader
BUpload
CMonitorNoHandIe
DMonitor

How the community answered

(51 responses)

A
2% (1)
C
94% (48)
D
4% (2)

Explanation

MonitorNoHandle is a type of input stanza that allows a Splunk forwarder to read files on Windows systems as Windows writes to them. It does this by using a kernel-mode filter driver to capture raw data as it gets written to the file. This input stanza is useful for files that get locked open for writing, such as the Windows DNS server log file.

Topics

#Splunk Forwarding#Windows file input#MonitorNoHandIe#File locking

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice