Exam SPLK-1005 topic 1 question 4 discussion

D is correct. # The following configuration reads all the files in the directory /var/log. [monitor:///var/log] Nothing else is required.

A. A monitor stanza, sourcetype, and index is required to ingest data. In inputs.conf, the syntax for ingesting data from files or directories requires at least the following: Monitor stanza: Specifies the file or directory to monitor, e.g., [monitor:///path/to/file_or_directory]. Sourcetype: Defines the type of data being ingested, which helps Splunk parse and categorize the data. Index: Specifies where the ingested data will be stored within Splunk. While additional settings like host can be configured, they are optional and not mandatory for basic ingestion

D is incoreect, because only monitor stanza does not ingest data. monitor stanza along with index will ingest data. A is correct.