Splunk Exam SPLK-1003 Topic 13 Question 83 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 83
Topic #: 13

[All SPLK-1003 Questions]

How does the Monitoring Console monitor forwarders?

ABy pulling internal logs from forwarders.

BBy using the forwarder monitoring add-on

CWith internal logs forwarded by forwarders.

DWith internal logs forwarded by deployment server.

Show Suggested Answer

Suggested Answer: C

The correct answer is C. /var/log/host_460352847/bar/file/foo.txt.

The monitor stanza in inputs.conf is used to configure Splunk to monitor files and directories for new data. The monitor stanza has the following syntax1:

[monitor://<input path>]

The input path can be a file or a directory, and it can include wildcards (*) and regular expressions. The wildcards match any number of characters, including none, while the regular expressions match patterns of characters. The input path is case-sensitive and must be enclosed in double quotes if it contains spaces1.

In this case, the input path is /var/log//bar/.txt, which means Splunk will monitor any file with the .txt extension that is located in a subdirectory named bar under the /var/log directory. The subdirectory bar can be at any level under the /var/log directory, and the * wildcard will match any characters before or after the bar and .txt parts1.

Therefore, the file /var/log/host_460352847/bar/file/foo.txt will be matched by the monitor stanza, as it meets the criteria. The other files will not be matched, because:

A) /var/log/host_460352847/temp/bar/file/csv/foo.txt has a .csv extension, not a .txt extension.

B) /var/log/host_460352847/bar/foo.txt is not located in a subdirectory under the bar directory, but directly in the bar directory.

D) /var/log/host_460352847/temp/bar/file/foo.txt is located in a subdirectory named file under the bar directory, not directly in the bar directory.

by Frederica at Mar 05, 2024, 04:45 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Loreen

1 months ago

Well, at least we know the Monitoring Console isn't monitoring the forwarders by reading their minds. That would be a pretty impressive feat of telepathy!

upvoted 0 times

Rachael

3 days ago

C) With internal logs forwarded by forwarders.

upvoted 0 times

...

Aimee

6 days ago

B) By using the forwarder monitoring add-on

upvoted 0 times

...

Phung

9 days ago

A) By pulling internal logs from forwarders.

upvoted 0 times

...

Gianna

2 months ago

Hmm, I was leaning towards D, but C is probably the way to go. The deployment server wouldn't be the one forwarding the logs, that doesn't make much sense.

upvoted 0 times

Kaitlyn

1 months ago

C) With internal logs forwarded by forwarders.

upvoted 0 times

...

Kara

1 months ago

B) By using the forwarder monitoring add-on

upvoted 0 times

...

Cortney

1 months ago

A) By pulling internal logs from forwarders.

upvoted 0 times

...

Nettie

2 months ago

I was thinking option B, the forwarder monitoring add-on, but C makes more sense. The console can't just pull the logs, the forwarders have to send them over.

upvoted 0 times