Splunk Core Certified Advanced Power User — Question 132

In inputs.conf, which stanza would mean Splunk was only reading one local file?

Answer options

• A. [monitor::/opt/log/crashlog/Jan27crash.txt]
• B. [monitor:///opt/log/crashlogs/Jan27crash.txt]
• C. [read://opt/log/crashlog/Jan27crash.txt]
• D. [monitor:///opt/log/]

Correct answer: B

Explanation

Option B is correct because it specifies a precise path to a single file using the 'monitor' input type. Option A has a syntax error with '::', and Option C uses an incorrect input type 'read', while Option D points to a directory rather than a specific file.