Splunk Core Certified Advanced Power User — Question 40

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

Answer options

• A. REGEX, DEST, FORMAT
• B. REGEX, SRC_KEY, FORMAT
• C. REGEX, DEST_KEY, FORMAT
• D. REGEX, DEST_KEY, FORMATTING

Correct answer: C

Explanation

The correct answer is C, as the required attributes for manipulating or removing events in the transforms.conf file are REGEX, DEST_KEY, and FORMAT. Options A and D include incorrect or additional attributes that are not necessary, while option B uses SRC_KEY, which is not a required attribute for this purpose.