Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

A. CLI

B. Edit inputs . conf

C. Edit forwarder.conf

D. Forwarder Management

In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

A. To ensure that hot buckets are still open for writes and have not been forced to roll to a cold state

B. To ensure that configuration files have not been tampered with for auditing and/or legal purposes

C. To ensure that user passwords have not been tampered with for auditing and/or legal purposes.

D. To ensure that data has not been tampered with for auditing and/or legal purposes

Which Splunk configuration file is used to enable data integrity checking?

A. props.conf

B. global.conf

C. indexes.conf

D. data_integrity.conf

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

Event:

[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

A. SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g

B. SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g

C. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g

D. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

When using a directory monitor input, specific source type can be selectively overridden using which configuration file?

A. props.conf

B. sourcetypes.conf

C. transforms.conf

D. outputs.conf