Splunk SPLK-1003 Exam - Topic 2 Question 66 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 66
Topic #: 2

When using a directory monitor input, specific source types can be selectively overridden using which configuration file?

Asourcetypes . conf

Btrans forms . conf

Coutputs . conf

Dprops . conf

Show Suggested Answer

Suggested Answer: C

by Dorthy at Feb 05, 2023, 11:50 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Phung

5 months ago

I agree, props.conf is the right one!

upvoted 0 times

...

Van

5 months ago

Wait, are you all sure about that?

upvoted 0 times

...

Phung

6 months ago

Nah, it's props.conf for sure.

upvoted 0 times

...

Annett

6 months ago

I thought it was sourcetypes.conf?

upvoted 0 times

...

Macy

6 months ago

It's definitely props.conf for overriding source types.

upvoted 0 times

...

Odette

6 months ago

I thought it was transforms.conf, but now that I think about it, props.conf seems more likely for overriding source types.

upvoted 0 times

...

Van

6 months ago

I’m leaning towards props.conf too, but I remember there being a lot of overlap between the different config files.

upvoted 0 times

...

Elbert

6 months ago

I feel like I saw a similar question about configuration files, and I think sourcetypes.conf was mentioned there. But I can't recall the specifics.

upvoted 0 times

...

Florencia

6 months ago

I think it's the props.conf file, but I'm not entirely sure. I remember something about it being used for data transformations.

upvoted 0 times

...

Ludivina

6 months ago

Hmm, I'm a bit unsure about this one. I know we can query the rule project, but I'm not sure exactly which elements are available. I'll have to think this through step-by-step.

upvoted 0 times

...

Torie

6 months ago

I'm leaning towards saying it's 20, but I also think there might have been some exceptions mentioned during our lessons.

upvoted 0 times

...

Arlyne

11 months ago

I'm going with D) props.conf. Gotta love those Splunk config files - they're like a secret language that only the true nerds understand.

upvoted 0 times

Aileen

10 months ago

I'm pretty sure it's D) props.conf. That's where you can configure how data is indexed and processed in Splunk.

upvoted 0 times

...

Onita

10 months ago

Actually, I believe it's B) transforms.conf. That's the file you use to apply field transformations to your data.

upvoted 0 times

...

Golda

10 months ago

I think it's A) sourcetypes.conf. That's where you can specify the source types for your inputs.

upvoted 0 times

...

Emiko

11 months ago

Ha, I bet the person who wrote this question was having a laugh. 'sourcetypes.conf'? Really? That's not even a thing!

upvoted 0 times

...

Lashawn

11 months ago

Hmm, I was thinking B) transforms.conf, but now that I think about it, that's more for transforming the data, not overriding source types. D) props.conf makes more sense.

upvoted 0 times