A log file is being ingested into Splunk, and a few events have no date stamp. How would Splunk first try to determine the missing date of the events?

Question

Zuzana Combs · Accepted Answer

Splunk will take the date from the file modification time.

Zuzana Combs · Answer

Splunk will take the date of a previous event within the log file.

Zuzana Combs · Answer

Splunk will use the current system time of the Indexer for the date.

Zuzana Combs · Answer

Splunk will use the date of when the file monitor was created.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 68 - SPLK-1005 discussion

Suggested answer: D

0 comments