Splunk Exam SPLK-1005 Topic 9 Question 8 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 8
Topic #: 9

[All SPLK-1005 Questions]

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

AThis can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.

BThe configuration changes can be made using Splunk Web. CU, directly in configuration files, or via a deployment app.

CThe configuration changes can be made using CU, directly in configuration files, or via a deployment app.

DIt is only possible to make this change directly in configuration files or via a deployment app.

Show Suggested Answer

Suggested Answer: B

When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.

Splunk Documentation Reference: props.conf configuration

by Chaya at Dec 09, 2024, 05:34 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Renea

2 months ago

Hmm, this question is making me hungry. I wonder if there's a 'Universal Forwarder Sandwich' on the menu today? Anyway, I'm gonna go with option C - can't go wrong with the classic config file approach. Less chance of accidentally clicking the wrong button and ending up with a 'Universal Disaster' on my hands!

upvoted 0 times

Genevive

16 days ago

I prefer option D. Directly editing configuration files gives me more control over the process.

upvoted 0 times

...

Dottie

1 months ago

I think I'll go with option B. Splunk Web is user-friendly and convenient for making changes.

upvoted 0 times

...

Virgina

1 months ago

I agree, option C seems like the safest choice. Config files are the way to go.

upvoted 0 times

...

Dalene

2 months ago

Ooh, option A sounds a bit too restrictive. I mean, come on, Splunk is all about flexibility, right? Option B is the way to go - get the best of both worlds, GUI and config files. Splunk devs must have been in a good mood when they came up with that one!

upvoted 0 times

...

Jennie

2 months ago

Haha, option D is just too limited. Who wants to be stuck making changes only through config files or a deployment app? That sounds like a real pain. I'll go with option B, gotta have that Splunk Web flexibility!

upvoted 0 times

Earnestine

9 days ago

Staci: Definitely, having the ability to make changes through Splunk Web is much more convenient.

upvoted 0 times

...

Delbert

28 days ago

User 3: I think option B is the way to go as well.

upvoted 0 times

...

Staci

1 months ago

User 2: Yeah, I prefer option B for the flexibility it offers.

upvoted 0 times

...

Annmarie

1 months ago

User 1: I agree, option D does seem too limited.

upvoted 0 times

...

Leota

2 months ago

Option C looks good to me. I prefer working directly with the config files or a deployment app - less chance of accidentally clicking the wrong button in the UI, you know? Although I guess Splunk Web is useful for the less technical folks.

upvoted 0 times

Nenita

1 months ago

User 2: I agree, less room for error that way. Splunk Web can be handy, but I prefer the control of config files.

upvoted 0 times

...

Frankie

1 months ago

User 1: Option C is definitely the way to go. Directly in config files or via a deployment app is the safest bet.

upvoted 0 times

...

Fabiola

2 months ago

Hmm, I think option B is the correct answer. Splunk Web provides a nice GUI for configuring the Universal Forwarder, but you can also make changes directly in the config files or through a deployment app. Makes sense to have multiple options, right?

upvoted 0 times

...