Splunk Core Certified Consultant — Question 17

What does the followTail attribute do in inputs.conf?

Answer options

• A. Pauses a file monitor if the queue is full.
• B. Only creates a tail checkpoint of the monitored file.
• C. Ingests a file starting with new content and then reading older events.
• D. Prevents pre-existing content in a file from being ingested.

Correct answer: D

Explanation

The correct answer, D, is accurate because the followTail attribute is designed to prevent already existing content in a file from being ingested, ensuring that only new entries are processed. Options A, B, and C are incorrect as they describe different functionalities that are not related to the followTail attribute.