ExamGecko
Question list
Search
Search

List of questions

Search

Question 37 - SPLK-1005 discussion

Report
Export

Which of the following is a valid stanza in props. conf?

A.

[sourcetype::linux_secure]

Answers
A.

[sourcetype::linux_secure]

B.

[host=nyc25]

Answers
B.

[host=nyc25]

C.

[host::nyc*]

Answers
C.

[host::nyc*]

D.

[host:nyc*]

Answers
D.

[host:nyc*]

Suggested answer: A

Explanation:

In props.conf, valid stanzas can include source types, hosts, and source specifications. The correct syntax uses colons for specific types, such as source types and hosts, but follows a particular format:

A . [sourcetype::linux_secure] is the correct answer. This is a valid stanza format for a source type in props.conf. It indicates that the following configurations apply specifically to the linux_secure source type.

B . [host=nyc25]: Incorrect, the correct format for a host-based stanza uses double colons, not an equal sign.

C . [host::nyc]:* Incorrect, wildcards are not used in this manner within props.conf.

D . [host

]:* Incorrect, the correct format requires double colons for host stanzas.

Splunk Documentation

Reference:

props.conf Specification

asked 10/10/2024
Ricardo de Sá Carvalho
38 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first