Discuss Splunk SPLK-1005 Exam Topic 11 Question 31

When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

Atransforms.conf

Bprops.conf

Cinputs.conf

Doutputs.cont

Suggested Answer: B

When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.

Splunk Documentation Reference: props.conf configuration

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

21 comments · newest first

Ludivina 2 days ago

Good luck to everyone!

Amie 7 days ago

Props.conf is the right choice for overrides.

Aron 12 days ago

Same here, but I’ll stick with B.

Whitney 17 days ago

I feel confused about this topic.

Anabel 23 days ago

True, but it can still affect sourcetypes.

Cherri 28 days ago

A is for transforming data, not sourcetypes.

Anabel 1 month ago

I’m leaning towards A) transforms.conf.

Amie 1 month ago

I agree, B makes sense.

Ludivina 1 month ago

It’s where sourcetypes are defined.

Aron 2 months ago

Why props.conf?

Ludivina 2 months ago

I think it's B) props.conf.

Whitney 2 months ago

Tough question!

Johanna 2 months ago

Definitely B) props.conf, that's the standard way.

Jerry 2 months ago

I can't believe it's B! That seems too simple.

Shawna 2 months ago

Wait, are you sure it's not C) inputs.conf?

Genevive 3 months ago

I thought it was A) transforms.conf?

Stanton 3 months ago

It's B) props.conf for overriding sourcetypes.

Kati 3 months ago

I feel like props.conf is the right answer because it deals with how data is processed, but I might be mixing it up with another topic.

Earlean 3 months ago

I practiced a question similar to this, and I think it was about inputs.conf, but that doesn't seem right for sourcetypes.

Katina 3 months ago

I remember something about transforms.conf being related to data transformation, but I can't recall if it applies here.

Lashawna 4 months ago

I think the file where you can override sourcetyping is props.conf, but I'm not entirely sure.

Splunk SPLK-1005 Exam - Topic 11 Question 31 Discussion