Splunk Exam SPLK-1005 Topic 8 Question 13 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 13
Topic #: 8

[All SPLK-1005 Questions]

Which of the following statements is true about data transformations using SEDCMD?

ACan only be used to mask or truncate raw data.

BConfigured in props.conf and transform.conf.

CCan be used to manipulate the sourcetype per event.

DOperates on a REGEX pattern match of the source, sourcetype, or host of an event.

Show Suggested Answer

Suggested Answer: B

The ellipsis (...) in [monitor:///var/log/.../*.log] allows Splunk to monitor files ending in .log in all nested directories under /var/log/. [Reference: Splunk Docs on monitor stanza syntax]

by Milly at Mar 24, 2025, 04:51 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Elliot

2 months ago

Option B has to be the right answer. Configuring data transformations in props.conf and transform.conf is the way to go. I wonder if there's a cheat sheet for all these Splunk commands?

upvoted 0 times

Charlene

9 days ago

Yes, data transformations using SEDCMD are definitely configured in props.conf and transform.conf. It's important to know where to make those changes.

upvoted 0 times

...

Lon

18 days ago

I'm not sure about a cheat sheet, but it would be helpful!

upvoted 0 times

...

Nichelle

28 days ago

I agree, that's the correct answer.

upvoted 0 times

...

Thea

1 months ago

B) Configured in props.conf and transform.conf.

upvoted 0 times

...

Fallon

1 months ago

I think there might be a cheat sheet out there for Splunk commands. It would be really helpful to have all the information in one place.

upvoted 0 times

...

Eden

1 months ago

I agree, option B is correct. Props.conf and transform.conf are where you configure data transformations.

upvoted 0 times

...

Iola

2 months ago

Ha! I bet the person who wrote this question is a big fan of data transformations. Personally, I'd rather be out on the beach than dealing with SEDCMD and props.conf.

upvoted 0 times

...

Alfred

2 months ago

I'm not sure about the details of SEDCMD, but option D sounds like it could be the right answer. Manipulating data based on a REGEX pattern match seems like a useful capability.

upvoted 0 times