Splunk Exam SPLK-1003 Topic 4 Question 105 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 105
Topic #: 4

[All SPLK-1003 Questions]

In inputs. conf, which stanza would mean Splunk was only reading one local file?

A[read://opt/log/crashlog/Jan27crash.txt]

B[monitor::/ opt/log/crashlog/Jan27crash.txt]

C[monitor:/// opt/log/]

D[monitor:/// opt/log/ crashlog/Jan27crash.txt]

Show Suggested Answer

Suggested Answer: B

[monitor::/opt/log/crashlog/Jan27crash.txt].This stanza means that Splunk is monitoring a single local file named Jan27crash.txt in the /opt/log/crashlog/ directory1.The monitor input type is used to monitor files and directories for changes and index any new data that is added2.

by Rafael at Nov 29, 2024, 10:19 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kimbery

15 days ago

Option B? Really? What is this, amateur hour? Everyone knows Splunk doesn't use colons in its file paths. Clearly A is the correct answer.

upvoted 0 times

...

Chandra

16 days ago

Pfft, this is easy. Everyone knows you use the 'monitor' stanza to watch directories, not files. A all the way, baby!

upvoted 0 times

Carin

2 days ago

A) [read://opt/log/crashlog/Jan27crash.txt]

upvoted 0 times

...

Deeann

17 days ago

Hmm, I'm torn between A and D. D looks like it's reading the whole directory and a specific file, but A is more straightforward. Decisions, decisions...

upvoted 0 times

...

Johna

18 days ago

I'm going with C. The '///' in the path means it's reading the entire directory, not just a single file.

upvoted 0 times

...

Renea

19 days ago

Option A looks right to me, the 'read://' stanza is used for reading a single local file.

upvoted 0 times

...

Alverta

20 days ago

I disagree, I believe the answer is B) [monitor::/opt/log/crashlog/Jan27crash.txt] because it specifies monitoring a specific file.

upvoted 0 times

...

Estrella

21 days ago

I think the answer is A) [read://opt/log/crashlog/Jan27crash.txt].

upvoted 0 times

...