Splunk Core Certified Advanced Power User — Question 55

Which is a valid stanza for a network input?

Answer options

• A. [udp://172.16.10.1:9997] connection = dns sourcetype = dns
• B. [any://172.16.10.1:10001] connection_host = ip sourcetype = web
• C. [tcp://172.16.10.1:9997] connection_host = web sourcetype = web
• D. [tcp://172.16.10.1:10001] connection_host = dns sourcetype = dns

Correct answer: D

Explanation

Option D is correct because it uses the proper TCP protocol and specifies the correct connection_host and sourcetype for DNS input. Option A is incorrect due to the use of UDP instead of TCP. Option B uses 'any' protocol and has an inappropriate connection_host for the web sourcetype. Option C has the wrong sourcetype and connection_host for the specified TCP connection.