Splunk Exam SPLK-1003 Topic 2 Question 66 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 66
Topic #: 2

When using a directory monitor input, specific source types can be selectively overridden using which configuration file?

Asourcetypes . conf

Btrans forms . conf

Coutputs . conf

Dprops . conf

Show Suggested Answer

Suggested Answer: C

by Dorthy at Feb 05, 2023, 11:50 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Arlyne

2 months ago

I'm going with D) props.conf. Gotta love those Splunk config files - they're like a secret language that only the true nerds understand.

upvoted 0 times

Aileen

28 days ago

I'm pretty sure it's D) props.conf. That's where you can configure how data is indexed and processed in Splunk.

upvoted 0 times

...

Onita

1 months ago

Actually, I believe it's B) transforms.conf. That's the file you use to apply field transformations to your data.

upvoted 0 times

...

Golda

1 months ago

I think it's A) sourcetypes.conf. That's where you can specify the source types for your inputs.

upvoted 0 times

...

Emiko

2 months ago

Ha, I bet the person who wrote this question was having a laugh. 'sourcetypes.conf'? Really? That's not even a thing!

upvoted 0 times

...

Lashawn

3 months ago

Hmm, I was thinking B) transforms.conf, but now that I think about it, that's more for transforming the data, not overriding source types. D) props.conf makes more sense.

upvoted 0 times

Tashia

2 months ago

Props.conf is the way to go for selectively overriding source types.

upvoted 0 times

...

Kizzy

2 months ago

Yes, transforms.conf is more for transforming the data.

upvoted 0 times

...

Rosendo

2 months ago

I agree, D) props.conf is used for overriding source types.

upvoted 0 times

...

Cyril

3 months ago

I'm not sure, but I think it might be B) trans forms . conf

upvoted 0 times

...

Joanna

3 months ago

I think the answer is D) props.conf, since that's where you can configure source type overrides for directory monitors.

upvoted 0 times

Elinore

2 months ago

I agree, it's definitely D) props.conf

upvoted 0 times

...

Tonette

2 months ago

No, I'm pretty sure it's D) props.conf

upvoted 0 times

...

Bulah

3 months ago

I think it's A) sourcetypes.conf actually

upvoted 0 times

...

Ressie

3 months ago

I believe the answer is D) props.conf

upvoted 0 times

...

Marvel

4 months ago

I agree with Buddy, because sourcetypes . conf is used to override specific source types

upvoted 0 times

...

Buddy

4 months ago

I think the answer is A) sourcetypes . conf

upvoted 0 times

...