The correct answer is C. MonitorNoHandle.
MonitorNoHandle is a type of input stanza that allows a Splunk forwarder to read files on Windows
systems as Windows writes to them. It does this by using a kernel-mode filter driver to capture raw
data as it gets written to the file1. This input stanza is useful for files that get locked open for writing,
such as the Windows DNS server log file2.
The other options are incorrect because:
A . Tail Reader is not a valid input stanza in Splunk. It is a component of the Tailing Processor, which is
responsible for monitoring files and directories for new data3.
B . Upload is a type of input stanza that allows Splunk to index a single file from a local or network file
system. It is not suitable for files that are constantly being updated, as it only indexes the file once
and does not monitor it for changes4.
D . Monitor is a type of input stanza that allows Splunk to monitor files and directories for new data.
However, it may not work for files that Windows prevents Splunk from reading while they are open.
In such cases, MonitorNoHandle is a better option2.
Reference
A Splunk forwarder is a lightweight agent that can forward data to a Splunk deployment. There are
two types of forwarders: universal and heavy. A universal forwarder can only forward data, while a
heavy forwarder can also perform parsing, filtering, routing, and aggregation on the data before
forwarding it5.
An input stanza is a section in the inputs.conf configuration file that defines the settings for a specific
type of input, such as files, directories, network ports, scripts, or Windows event logs. An input
stanza starts with a square bracket, followed by the input type and the input path or name. For
example, [monitor:///var/log] is an input stanza for monitoring the /var/log directory.
