Splunk Core Certified Advanced Power User — Question 104

Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log

Answer options

• A. [monitor:///var/log/.../secure.*]
• B. [monitor:///var/log/www1/secure.*]
• C. [monitor:///var/log/www1/secure.log]
• D. [monitor:///var/log/www*/secure.*]

Correct answer: A

Explanation

Option A is correct because it uses a wildcard to match any directory in '/var/log/' and any file that starts with 'secure.' This allows it to include all specified log files. The other options are too specific and do not account for the different directory structures or file names present in the examples.