SPLK-1003 · Question #196
There is a file with a vast amount of old data. Which of the following inputs. conf attributes would allow an admin to monitor the file for updates without indexing the pre-existing data?
The correct answer is A. followTail. Setting 'followTail = 1' in an inputs.conf monitor stanza instructs Splunk to seek to the end of the file before beginning to index, effectively ignoring all pre-existing content and only capturing new data appended after monitoring starts. 'ignoreOlderThan' excludes files…
Question
There is a file with a vast amount of old data. Which of the following inputs. conf attributes would allow an admin to monitor the file for updates without indexing the pre-existing data?
Options
- AfollowTail
- BignoreOlderThan
- Cmonitor
- DallowList
How the community answered
(33 responses)- A88% (29)
- B3% (1)
- C6% (2)
- D3% (1)
Explanation
Setting 'followTail = 1' in an inputs.conf monitor stanza instructs Splunk to seek to the end of the file before beginning to index, effectively ignoring all pre-existing content and only capturing new data appended after monitoring starts. 'ignoreOlderThan' excludes files whose modification time is older than a threshold, but still indexes existing content in qualifying files. 'monitor' is the stanza type, not a behavioral attribute. 'allowList' (formerly whiteList) filters which files to monitor by name pattern but does not skip existing content.
Topics
Community Discussion
No community discussion yet for this question.