Exam SPLK-1003 topic 1 question 134 discussion

Actual exam question from Splunk's SPLK-1003

Question #: 134
Topic #: 1

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user’s local context to disable the field aliases?

Show Suggested Answer

Suggested Answer: B 🗳️

by pieter543 at Jan. 23, 2023, 11:39 a.m.

Comments

Submit Cancel

FrozenYeti

5 months, 3 weeks ago

Selected Answer: B

Answer is B. Setting the key value pair to blank will remove not place a value for that field.

upvoted 1 times

...

hujinki

9 months, 1 week ago

Selected Answer: B

D is NOT the answer. There are two files : default and user. User have precedence BUT "#" symbol is a comment, and the line will be ignored. It will not override default. Answer is B.

upvoted 1 times

NastyNutsu

5 months, 4 weeks ago

That's a great observation! B explicitly overrides the default aliases by setting them to empty values, ensuring they are removed from the user's context

upvoted 1 times

...

Mntman77

2 years ago

B is correct Open the outputs.conf file in your local directory. Find the forwardedindex.0.whitelist setting and change the value to null. For example: forwardedindex.0.whitelist =

upvoted 1 times

...

harrytbb

2 years, 5 months ago

Selected Answer: B

I would go for B. "You clear a setting by changing its value to null." Reference: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Clear%20a%20setting

upvoted 3 times

...