ExamGecko
Search Search Login
Home Home / Splunk / SPLK-1003
Question list
Search
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309 Event: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
Which is a valid stanza for a network input?
In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?
What are the minimum required settings when creating a network input in Splunk?
Consider the following stanza in inputs.conf: What will the value of the source filed be for events generated by this scripts input?
Local user accounts created in Splunk store passwords in which file?
Which Splunk component(s) would break a stream of syslog inputs into individual events? (select all that apply)
Running this search in a distributed environment: On what Splunk component does the eval command get executed?
User role inheritance allows what to be inherited from the parent role? (select all that apply)
Which of the following Splunk components require a separate installation package?

Question 159 - SPLK-1003 discussion

Report
Export

What is the correct example to redact a plain-text password from raw events?

A.
in props.conf: [identity] REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
Answers
A.
in props.conf: [identity] REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
B.
in props.conf: [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
Answers
B.
in props.conf: [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
C.
in transforms.conf: [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
Answers
C.
in transforms.conf: [identity] SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
D.
in transforms.conf: [identity] REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
Answers
D.
in transforms.conf: [identity] REGEX-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g
Suggested answer: B

Explanation:

The correct answer is B. in props.conf:

[identity]

SEDCMD-redact_pw = s/password=([^,|/s]+)/ ####REACTED####/g

According to the Splunk documentation1, to redact sensitive data from raw events, you need to use the SEDCMD attribute in the props.conf file. The SEDCMD attribute applies a sed expression to the raw data before indexing. The sed expression can use the s command to replace a pattern with a substitution string. For example, the following sed expression replaces any occurrence of password= followed by any characters until a comma, whitespace, or slash with ####REACTED####:

s/password=([^,|/s]+)/ ####REACTED####/g

The g flag at the end means that the replacement is applied globally, not just to the first match.

Option A is incorrect because it uses the REGEX attribute instead of the SEDCMD attribute. The REGEX attribute is used to extract fields from events, not to modify them.

Option C is incorrect because it uses the transforms.conf file instead of the props.conf file. The transforms.conf file is used to define transformations that can be applied to fields or events, such as lookups, evaluations, or replacements. However, these transformations are applied after indexing, not before.

Option D is incorrect because it uses both the wrong attribute and the wrong file. There is no REGEX-redact_pw attribute in the transforms.conf file.

Show Answer
asked 23/09/2024
Bill Skadden
31 questions
PreviousPreviousNextNext
User
Your answer:
0 comments
Sorted by

Leave a comment first

ExamGecko

Copyright @2023 ExamGecko | All right reserved

Mail us: [email protected]
About us
Contact us
Twitter X
Facebook
Medium
Convert VPLUS to PDF
Open VPLUS files Easily and Quickly
Privacy Policy
Disclaimer
Terms