Question 1

What conf file needs to be edited to set up distributed search groups?

Options :

A : props.conf

B : search.conf

C : distsearch.conf

D : distibutedsearch.conf

Answer: C

Question 2

What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

Options :

A : REGEX, DEST. FORMAT

B : REGEX. SRC_KEY, FORMAT

C : REGEX, DEST_KEY, FORMAT

D : REGEX, DEST_KEY FORMATTING

Answer: C

Question 3

An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?