Splunk SPLK-1005 Exam - Topic 12 Question 14 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 14
Topic #: 12

[All SPLK-1005 Questions]

Which of the following files is used for both search-time and index-time configuration?

Ainputs.conf

Bprops.conf

Cmacros.conf

Dsavesearch.conf

Show Suggested Answer

Suggested Answer: B

The props.conf file is a crucial configuration file in Splunk that is used for both search-time and index-time configurations.

At index-time, props.conf is used to define how data should be parsed and indexed, such as timestamp recognition, line breaking, and data transformations.

At search-time, props.conf is used to configure how data should be searched and interpreted, such as field extractions, lookups, and sourcetypes.

B . props.conf is the correct answer because it is the only file listed that serves both index-time and search-time purposes.

Splunk Documentation Reference:

props.conf - configuration for search-time and index-time

by Belen at Apr 03, 2025, 04:56 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Brittney

5 months ago

Yeah, inputs.conf is the right one!

upvoted 0 times

...

Daniel

5 months ago

Wait, are you sure about that?

upvoted 0 times

...

Marti

5 months ago

Definitely inputs.conf!

upvoted 0 times

...

Xenia

6 months ago

I thought it was props.conf?

upvoted 0 times

...

Xuan

6 months ago

Seems too simple, but I guess it makes sense.

upvoted 0 times

...

Buddy

6 months ago

I have a vague memory of savesearch.conf being related to searches, but I don't think it fits the index-time part.

upvoted 0 times

...

Sherman

6 months ago

I’m leaning towards macros.conf, but I can't recall if it really applies to both times.

upvoted 0 times

...

Tegan

7 months ago

I remember practicing a question about configuration files, and I feel like inputs.conf was mentioned a lot in that context.

upvoted 0 times

...

Lili

7 months ago

I think it might be props.conf, but I'm not entirely sure if it covers both search-time and index-time.

upvoted 0 times

...

Ryan

7 months ago

B. props.conf is the file that handles both search-time and index-time configuration.

upvoted 0 times

...

Gene

7 months ago

Okay, let me think this through. I believe props.conf is the correct answer, but I want to make sure I'm not missing anything.

upvoted 0 times

...

Yesenia

7 months ago

I think the answer is B. props.conf is used for both search-time and index-time settings.

upvoted 0 times

...

Virgilio

8 months ago

Hmm, I'm a bit confused on this one. I'll need to double-check the documentation to be sure.

upvoted 0 times

...

Marleen

8 months ago

I'm pretty sure it's props.conf, that's the one that handles both search-time and index-time configuration.

upvoted 0 times

...

Eileen

1 year ago

Hmm, I think I'll go with B) props.conf. It's the Gandalf of Splunk files - the one that knows all the secrets.

upvoted 0 times

...

Darrel

1 year ago

I'm confident that B) props.conf is the correct answer. It's like the junk drawer of Splunk - it has everything you need!

upvoted 0 times

...

Rory

1 year ago

I was just about to say the same thing! props.conf is the Swiss Army knife of Splunk configuration files.

upvoted 0 times

...

Cordelia

1 year ago

B) props.conf is definitely the right answer. It's the go-to file for both search-time and index-time configurations.

upvoted 0 times

Donette

11 months ago

C) macros.conf is used for defining reusable pieces of search logic.

upvoted 0 times

...

Lorrine

11 months ago

B) props.conf is used for both search-time and index-time configuration.

upvoted 0 times

...

Lorrine

11 months ago

A) inputs.conf is used for search-time configuration only.

upvoted 0 times

...

Yasuko

1 year ago

I'm not sure, but I think savesearch.conf is also used for configuration.

upvoted 0 times

...

Glynda

1 year ago

I agree with Stevie, props.conf is used for both search-time and index-time configuration.

upvoted 0 times

...

Stevie

1 year ago

I think the answer is B) props.conf.

upvoted 0 times

...