ExamGecko
Question list
Search
Search

List of questions

Search

Question 52 - SPLK-1005 discussion

Report
Export

Li was asked to create a Splunk configuration to monitor syslog files stored on Linux servers at their organization. This configuration will be pushed out to multiple systems via a Splunk app using the on-prem deployment server.

The system administrators have provided Li with a directory listing for the logging locations on three syslog hosts, which are representative of the file structure for all systems collecting this data. An example from each system is shown below:

A)

B)

C)

D)

A.

Option A

Answers
A.

Option A

B.

Option B

Answers
B.

Option B

C.

Option C

Answers
C.

Option C

D.

Option D

Answers
D.

Option D

Suggested answer: A

Explanation:

The correct monitor statement that will capture all variations of the syslog file paths across different systems is [monitor:///var/log/network/syslog*/linux_secure/*].

This configuration works because:

syslog* matches directories that start with 'syslog' (like syslog01, syslog02, etc.).

The wildcard * after linux_secure/ will capture all files within that directory, including different filenames like syslog.log and syslog.log.2020090801.

This setup will ensure that all the necessary files from the different syslog hosts are monitored.

Splunk Documentation

Reference: Monitor files and directories

asked 10/10/2024
Emmanuel ogoro
34 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first