Splunk Exam SPLK-1005 Topic 9 Question 8 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 8
Topic #: 9

When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

Atransforms.conf

Bprops.conf

Cinputs.conf

Doutputs.cont

Show Suggested Answer

Suggested Answer: B

When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.

Splunk Documentation Reference: props.conf configuration

by Chaya at Dec 09, 2024, 05:34 AM

Limited Time Offer

25%

18 days ago

Definitely props.conf. That's where the magic happens when it comes to configuring file inputs.

upvoted 0 times

Willodean

4 days ago

A) transforms.conf

upvoted 0 times

...

Eric

20 days ago

I'm pretty sure it's props.conf. That's where we define our sourcetypes and other file-level settings.

upvoted 0 times

Yuki

2 days ago

B) props.conf

upvoted 0 times

...

Olga

10 days ago

A) transforms.conf

upvoted 0 times

...