MENU
When using a directory monitor input, specific source types can be selectively overridden using which configuration file?
Suggested Answer: C
Get Premium SPLK-1003 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
28 comments · newest first
PH
Phung
11 months ago
I agree, props.conf is the right one!
VA
Van
11 months ago
Wait, are you all sure about that?
PH
Phung
12 months ago
Nah, it's props.conf for sure.
AN
Annett
12 months ago
I thought it was sourcetypes.conf?
MA
Macy
12 months ago
It's definitely props.conf for overriding source types.
OD
Odette
1 year ago
I thought it was transforms.conf, but now that I think about it, props.conf seems more likely for overriding source types.
VA
Van
1 year ago
I’m leaning towards props.conf too, but I remember there being a lot of overlap between the different config files.
EL
Elbert
1 year ago
I feel like I saw a similar question about configuration files, and I think sourcetypes.conf was mentioned there. But I can't recall the specifics.
FL
Florencia
1 year ago
I think it's the props.conf file, but I'm not entirely sure. I remember something about it being used for data transformations.
LU
Ludivina
1 year ago
Hmm, I'm a bit unsure about this one. I know we can query the rule project, but I'm not sure exactly which elements are available. I'll have to think this through step-by-step.
TO
Torie
1 year ago
I'm leaning towards saying it's 20, but I also think there might have been some exceptions mentioned during our lessons.
AR
Arlyne
1 year ago
I'm going with D) props.conf. Gotta love those Splunk config files - they're like a secret language that only the true nerds understand.
AI
Aileen
1 year ago
I'm pretty sure it's D) props.conf. That's where you can configure how data is indexed and processed in Splunk.
ON
Onita
1 year ago
Actually, I believe it's B) transforms.conf. That's the file you use to apply field transformations to your data.
GO
Golda
1 year ago
I think it's A) sourcetypes.conf. That's where you can specify the source types for your inputs.
EM
Emiko
1 year ago
Ha, I bet the person who wrote this question was having a laugh. 'sourcetypes.conf'? Really? That's not even a thing!
LA
Lashawn
1 year ago
Hmm, I was thinking B) transforms.conf, but now that I think about it, that's more for transforming the data, not overriding source types. D) props.conf makes more sense.
TA
Tashia
1 year ago
Props.conf is the way to go for selectively overriding source types.
KI
Kizzy
1 year ago
Yes, transforms.conf is more for transforming the data.
RO
Rosendo
1 year ago
I agree, D) props.conf is used for overriding source types.
CY
Cyril
2 years ago
I'm not sure, but I think it might be B) trans forms . conf
JO
Joanna
2 years ago
I think the answer is D) props.conf, since that's where you can configure source type overrides for directory monitors.
EL
Elinore
1 year ago
I agree, it's definitely D) props.conf
TO
Tonette
1 year ago
No, I'm pretty sure it's D) props.conf
BU
Bulah
1 year ago
I think it's A) sourcetypes.conf actually
RE
Ressie
1 year ago
I believe the answer is D) props.conf
MA
Marvel
2 years ago
I agree with Buddy, because sourcetypes . conf is used to override specific source types
BU
Buddy
2 years ago
I think the answer is A) sourcetypes . conf