SPLK-1003 Exam Dumps | Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will

<< Prev Question Next Question >>

Question 25/42

Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309 Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

A. SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g

B. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

C. SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g

D. SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g

Question 25/42

LEAVE A REPLY

Download PDF File