ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-1003 All Questions

View all questions & answers for the SPLK-1003 exam
Go to Exam

Exam SPLK-1003 topic 1 question 134 discussion

Actual exam question from Splunk's SPLK-1003
Question #: 134
Topic #: 1
[All SPLK-1003 Questions]

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user’s local context to disable the field aliases?

  • A.
  • B.
  • C.
  • D.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by pieter543 at Jan. 23, 2023, 11:39 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
FrozenYeti
2 months, 2 weeks ago
Selected Answer: B
Answer is B. Setting the key value pair to blank will remove not place a value for that field.
upvoted 1 times
...
hujinki
6 months, 1 week ago
Selected Answer: B
D is NOT the answer. There are two files : default and user. User have precedence BUT "#" symbol is a comment, and the line will be ignored. It will not override default. Answer is B.
upvoted 1 times
NastyNutsu
2 months, 3 weeks ago
That's a great observation! B explicitly overrides the default aliases by setting them to empty values, ensuring they are removed from the user's context
upvoted 1 times
...
...
Mntman77
1 year, 9 months ago
B is correct Open the outputs.conf file in your local directory. Find the forwardedindex.0.whitelist setting and change the value to null. For example: forwardedindex.0.whitelist =
upvoted 1 times
...
harrytbb
2 years, 2 months ago
Selected Answer: B
I would go for B. "You clear a setting by changing its value to null." Reference: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Clear%20a%20setting
upvoted 3 times
...
beastmode1
2 years, 2 months ago
B place no content to remove from output
upvoted 3 times
...
random0352
2 years, 2 months ago
Selected Answer: D
Answer D looks correct. The field alias has been commented out using '#'
upvoted 2 times
...
pieter543
2 years, 2 months ago
Why not D?
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago