1. Home
  2. Discussions
  3. Splunk
  4. Splunk Enterprise Certified Admin
  5. SPLK-1003 Discussions
  6. SPLK-1003 Exam Topic 4 Question 30 Discussion

Splunk Enterprise Certified Admin SPLK-1003 Question # 30 Topic 4 Discussion

 Splunk Discussions      Browse All Questions      Go to Exam Detail      Get Premium Access
 Previous
Next  

Splunk Enterprise Certified Admin SPLK-1003 Question # 30 Topic 4 Discussion

SPLK-1003 Exam Topic 4 Question 30 Discussion:
Question #: 30
Topic #: 4

UsingSEDCMDinprops.confallows raw data to be modified. With the given event below, which option will mask the first three digits of theAcctIDfield resulting output:[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

Event:

[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
A.

SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g

B.

SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g

C.

SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g

D.

SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

Get Premium SPLK-1003 Questions
Actual exam question for Splunk SPLK-1003 exam by Hale61542 at Oct 20, 2025, 9:03:55 AM

Contribute your Thoughts:


Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.

Submit
 Previous
Next