Exam SPLK-1003 topic 1 question 100 discussion

Actual exam question from Splunk's SPLK-1003

Question #: 100
Topic #: 1

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

A. SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g
B. SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g
C. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g
D. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

Show Suggested Answer

Suggested Answer: D 🗳️

by loky0 at Aug. 27, 2021, 6:34 a.m.

Comments

Submit Cancel

loky0

Highly Voted 1 year, 3 months ago

should be D. the \1 indicates the capture group, should come after the xxx not before

upvoted 5 times

ucsdmiami2020

1 year, 2 months ago

Confirmed via Splunk docs https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Anonymizedata Scrolling down to the section titled "Define the sed script in props.conf shows the correct syntax of an example which validates that the number/character /1 immediately preceded the /g

upvoted 1 times

...

Seba0297

Most Recent 6 months, 3 weeks ago

Selected Answer: D

"SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g" follows the SEDCMD rule "s/<regex>/<replacement>/<flags>" In this case we are re-writing AcctID with three 'x', appending then the first (and only one) capture group, made of 4 digits

upvoted 3 times

...

Pacheco

1 year, 3 months ago

Right answer is D

upvoted 2 times

...