Splunk Exam SPLK-1003 Topic 12 Question 65 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 65
Topic #: 12

[All SPLK-1003 Questions]

Which of the following statements apply to directory inputs? {select all that apply)

AAll discovered text files are consumed.

BCompressed files are ignored by default

CSplunk recursively traverses through the directory structure.

DWhen adding new log files to a monitored directory, the forwarder must be restarted to take them into account.

Show Suggested Answer

Suggested Answer: C

Reference https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Configurationparametersandthedatapipeline

by Jutta at Jan 09, 2023, 06:30 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lashawn

1 months ago

Ah, the age-old directory input dilemma. A, C, and D are like the holy trinity of Splunk knowledge. As for B, it's probably just there to see who's paying attention. I bet the Splunk devs have a good laugh every time someone gets caught out by that one.

upvoted 0 times

...

Dorthy

1 months ago

Hmm, let me think... A, C, and D sound right. But B? Really? Maybe Splunk is trying to trick us here. I bet the compressed files are actually consumed by default. Time to consult the Splunk docs again...

upvoted 0 times

...

Sharen

1 months ago

I think I got it figured out. A, C, and D are correct. As for the compressed files, who cares? Just unzip them first and let Splunk do its thing. Easy peasy!

upvoted 0 times

Marguerita

6 days ago

It's important to restart the forwarder when adding new log files to a monitored directory.

upvoted 0 times

...

Darrin

9 days ago

Yeah, just unzip the compressed files before adding them to Splunk.

upvoted 0 times

...

Francene

1 months ago

I agree, A, C, and D are the correct statements for directory inputs.

upvoted 0 times

...

2 months ago

I'm pretty sure A, C, and D are correct. Splunk definitely recursively traverses directories, and the forwarder needs to be restarted to pick up new log files. But I'm not sure about the compressed files - I thought Splunk could handle those too.

upvoted 0 times