Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Splunk Exam SPLK-1005 Topic 12 Question 14 Discussion

Actual exam question for Splunk's SPLK-1005 exam
Question #: 14
Topic #: 12
[All SPLK-1005 Questions]

Which of the following files is used for both search-time and index-time configuration?

Show Suggested Answer Hide Answer
Suggested Answer: B

The props.conf file is a crucial configuration file in Splunk that is used for both search-time and index-time configurations.

At index-time, props.conf is used to define how data should be parsed and indexed, such as timestamp recognition, line breaking, and data transformations.

At search-time, props.conf is used to configure how data should be searched and interpreted, such as field extractions, lookups, and sourcetypes.

B . props.conf is the correct answer because it is the only file listed that serves both index-time and search-time purposes.

Splunk Documentation Reference:

props.conf - configuration for search-time and index-time


Contribute your Thoughts:

Stevie
1 days ago
I think the answer is B) props.conf.
upvoted 0 times
...

Save Cancel