MENU
Which of the following files is used for both search-time and index-time configuration?
Suggested Answer: B
Get Premium SPLK-1005 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The props.conf file is a crucial configuration file in Splunk that is used for both search-time and index-time configurations.
At index-time, props.conf is used to define how data should be parsed and indexed, such as timestamp recognition, line breaking, and data transformations.
At search-time, props.conf is used to configure how data should be searched and interpreted, such as field extractions, lookups, and sourcetypes.
B . props.conf is the correct answer because it is the only file listed that serves both index-time and search-time purposes.
Splunk Documentation Reference:
props.conf - configuration for search-time and index-time
24 comments · newest first
BR
Brittney
10 months ago
Yeah, inputs.conf is the right one!
DA
Daniel
10 months ago
Wait, are you sure about that?
MA
Marti
10 months ago
Definitely inputs.conf!
XE
Xenia
10 months ago
I thought it was props.conf?
XU
Xuan
10 months ago
Seems too simple, but I guess it makes sense.
BU
Buddy
11 months ago
I have a vague memory of savesearch.conf being related to searches, but I don't think it fits the index-time part.
SH
Sherman
11 months ago
I’m leaning towards macros.conf, but I can't recall if it really applies to both times.
TE
Tegan
11 months ago
I remember practicing a question about configuration files, and I feel like inputs.conf was mentioned a lot in that context.
LI
Lili
11 months ago
I think it might be props.conf, but I'm not entirely sure if it covers both search-time and index-time.
RY
Ryan
12 months ago
B. props.conf is the file that handles both search-time and index-time configuration.
GE
Gene
12 months ago
Okay, let me think this through. I believe props.conf is the correct answer, but I want to make sure I'm not missing anything.
YE
Yesenia
12 months ago
I think the answer is B. props.conf is used for both search-time and index-time settings.
VI
Virgilio
1 year ago
Hmm, I'm a bit confused on this one. I'll need to double-check the documentation to be sure.
MA
Marleen
1 year ago
I'm pretty sure it's props.conf, that's the one that handles both search-time and index-time configuration.
EI
Eileen
1 year ago
Hmm, I think I'll go with B) props.conf. It's the Gandalf of Splunk files - the one that knows all the secrets.
DA
Darrel
1 year ago
I'm confident that B) props.conf is the correct answer. It's like the junk drawer of Splunk - it has everything you need!
RO
Rory
1 year ago
I was just about to say the same thing! props.conf is the Swiss Army knife of Splunk configuration files.
CO
Cordelia
1 year ago
B) props.conf is definitely the right answer. It's the go-to file for both search-time and index-time configurations.
DO
Donette
1 year ago
C) macros.conf is used for defining reusable pieces of search logic.
LO
Lorrine
1 year ago
B) props.conf is used for both search-time and index-time configuration.
LO
Lorrine
1 year ago
A) inputs.conf is used for search-time configuration only.
YA
Yasuko
1 year ago
I'm not sure, but I think savesearch.conf is also used for configuration.
GL
Glynda
1 year ago
I agree with Stevie, props.conf is used for both search-time and index-time configuration.
ST
Stevie
2 years ago
I think the answer is B) props.conf.