ExamGecko
Question list
Search
Search

List of questions

Search

Question 57 - SPLK-1005 discussion

Report
Export

When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

A.

transforms.conf

Answers
A.

transforms.conf

B.

props.conf

Answers
B.

props.conf

C.

inputs.conf

Answers
C.

inputs.conf

D.

outputs.cont

Answers
D.

outputs.cont

Suggested answer: B

Explanation:

When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.

Splunk Documentation

Reference: props.conf configuration

asked 10/10/2024
Shaharyar Chaudhry
42 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first