Splunk Core Certified Consultant — Question 15

Which of the following are valid settings for file and directory monitor inputs?

Answer options

• A. host, index, source_length, _TCP_Routing, host_segment
• B. host, index, sourcetype, _TCP_Routing, host_regex, host_segment
• C. host, index, directory, host_regex, host_segment
• D. host, index, sourcetype, _UDP_Routing, host_regex, host_segment

Correct answer: B

Explanation

Option B is correct because it includes 'sourcetype', which is a key setting for inputs in file and directory monitoring. The other options either lack 'sourcetype' or include incorrect fields such as 'source_length' or '_UDP_Routing', which are not valid in this context.