Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Free Preparation Discussions
MENU
Splunk Exam SPLK-1005 Topic 5 Question 4 Discussion
Actual exam question for
Splunk's
SPLK-1005 exam
Question #: 4
Topic #: 5
[All SPLK-1005 Questions]
Topic #: 5
When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?
Suggested Answer:
B
When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.
Splunk Documentation Reference: props.conf configuration
Currently there are no comments in this discussion, be the first to comment!