Self-assessment

In this section, there are 10 questions followed by answers for you to test your learning throughout this chapter. If you run into difficulty in answering any of the questions, do refer to the respective section:

1. What is the next phase in data indexing right after the input phase?
   1. Indexing
   2. Parsing
   3. Masking
   4. Routing
2. Identify the stanzas that can be created in props.conf. (Select all that apply.)
   1. [source]
   2. [sourcetype_name]
   3. [source::<source_name_or_pattern>]
   4. [host]
   5. [host::<hostname_or_pattern>
3. What are the parsing phase capabilities? (Select all that apply.)
   1. Override a source type
   2. Re-route to a different index
   3. Data masking
   4. Drop events that do not need to be indexed
4. What is the name of the queue to be set for dropping unwanted events from indexing?
   1. sinkHole
   2. deadQueue
   3. nullQueue
   4. dropQueue
5. The SEDCMD setting belongs to the transforms.conf file. Is this statement true or false?
   1. True
   2. False
6. What is the limit of the file upload size in Splunk Web for the Set...