What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

The correct answer is C. REGEX, DEST_KEY, FORMAT. When configuring transforms.conf to manipulate or remove events (such as routing events to the null queue to drop them), three attributes are required: REGEX (the regular expression pattern that identifies which events to act on), DEST_KEY (the destination field to modify - commo

Configuration Files

Question

Options

AREGEX, DEST. FORMAT
BREGEX. SRC_KEY, FORMAT
CREGEX, DEST_KEY, FORMAT
DREGEX, DEST_KEY FORMATTING

How the community answered

(16 responses)

A
6% (1)
C
88% (14)
D
6% (1)

Explanation

When configuring transforms.conf to manipulate or remove events (such as routing events to the null queue to drop them), three attributes are required: REGEX (the regular expression pattern that identifies which events to act on), DEST_KEY (the destination field to modify - commonly set to 'queue' for event routing/dropping), and FORMAT (the replacement value or routing destination - for dropping events, this is set to 'nullQueue'). For example, to drop events matching a pattern: REGEX = <pattern>, DEST_KEY = queue, FORMAT = nullQueue. The other options either misspell attribute names (DEST.FORMAT, FORMATTING) or include incorrect attributes (SRC_KEY is used in field extraction, not event manipulation).

Topics

#transforms.conf#event manipulation#configuration files#regex

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice