Which stanza value in defines index-time data masking? props.conf

The correct answer is C. TRANSFORMS. TRANSFORMS is the props.conf setting that links to a transforms.conf stanza at index time, enabling operations like data masking (sedcmd), routing, and field transformations before data is written to disk. EXTRACT and REPORT are search-time field extraction directives - they do…

Splunk Indexing

Question

Which stanza value in defines index-time data masking? props.conf

Options

AEXTRACT
BREPORT
CTRANSFORMS
DTRUNCATE

How the community answered

(27 responses)

B
4% (1)
C
89% (24)
D
7% (2)

Explanation

TRANSFORMS is the props.conf setting that links to a transforms.conf stanza at index time, enabling operations like data masking (sedcmd), routing, and field transformations before data is written to disk. EXTRACT and REPORT are search-time field extraction directives - they do not alter raw event data. TRUNCATE sets the maximum number of characters per event and has no masking capability. Because TRANSFORMS-linked stanzas execute at index time, they can permanently alter or mask sensitive data (e.g., credit card numbers) before storage.

Topics

#props.conf#data masking#index-time processing#transforms.conf

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice