Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

Splunk Exam SPLK-1005 Topic 9 Question 8 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 8
Topic #: 9

[All SPLK-1005 Questions]

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

AThis can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.

BThe configuration changes can be made using Splunk Web. CU, directly in configuration files, or via a deployment app.

CThe configuration changes can be made using CU, directly in configuration files, or via a deployment app.

DIt is only possible to make this change directly in configuration files or via a deployment app.

Show Suggested Answer

Suggested Answer: B

When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.

Splunk Documentation Reference: props.conf configuration

by Chaya at Dec 09, 2024, 05:34 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jennie

4 days ago

Haha, option D is just too limited. Who wants to be stuck making changes only through config files or a deployment app? That sounds like a real pain. I'll go with option B, gotta have that Splunk Web flexibility!

upvoted 0 times

...

Leota

13 days ago

Option C looks good to me. I prefer working directly with the config files or a deployment app - less chance of accidentally clicking the wrong button in the UI, you know? Although I guess Splunk Web is useful for the less technical folks.

upvoted 0 times

...

Fabiola

14 days ago

Hmm, I think option B is the correct answer. Splunk Web provides a nice GUI for configuring the Universal Forwarder, but you can also make changes directly in the config files or through a deployment app. Makes sense to have multiple options, right?

upvoted 0 times

...

Lovetta

14 days ago

Why do you think C is correct?

upvoted 0 times

...

Junita

18 days ago

I disagree, I believe the correct answer is C.

upvoted 0 times

...

Lovetta

23 days ago

I think the answer is B.

upvoted 0 times

...

az-700 pass4success az-104 200-301 200-201 cissp 350-401 350-201 350-501 350-601 350-801 350-901 az-720 az-305 pl-300

Warning: Cannot modify header information - headers already sent by (output started at /pass.php:70) in /pass.php on line 77