Splunk Core Certified Advanced Power User — Question 168

Windows can prevent a Splunk forwarder from reading open files. If files need to be read while they are being written to, what type of input stanza needs to be created?

Answer options

• A. Upload
• B. TailReader
• C. Monitor
• D. MonitorNoHandle

Correct answer: D

Explanation

The correct answer is D, MonitorNoHandle, which allows Splunk to read files that are open and being written to without being blocked by Windows file access restrictions. The other options, such as Upload, TailReader, and Monitor, do not provide this capability and would not work for reading open files in this scenario.