Splunk Core Certified Consultant — Question 21

What is the correct syntax to monitor /apache/foo/logs, /apache/bar/logs, and /apache/bar/1/logs?

Answer options

• A. (monitor:///apache/*/logs]
• B. (monitor:///apache/foo/logs, /apache/bar/logs, /apache/bar/1/logs]
• C. [monitor:///apache/.../logs]
• D. [monitor:///apache/foo/logs, /apache/bar/logs, and /apache/bar/1/logs]

Correct answer: C

Explanation

The correct answer is C because the syntax '[monitor:///apache/.../logs]' effectively captures all specified paths by using the ellipsis to indicate any directory level in that position. Options A and B are incorrect as they either use the wrong brackets or do not provide a general matching syntax for the paths. Option D includes unnecessary wording 'and' which makes it syntactically incorrect.