Splunk Exam SPLK-1005 Topic 4 Question 15 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 15
Topic #: 4

A monitor has been created in inputs. con: for a directory that contains a mix of file types.

How would a Cloud Admin fine-tune assigned sourcetypes for different files in the directory during the input phase?

AOn the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.

BOn the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props. conf that assigns a specific sourcetype by source stanza.

COn the Indexer parsing the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props, com that filters out unwanted files.

DOn the forwarder collecting the data, set multiple 3ourcotype_sourc attributes for the directory monitor collecting the files. Then create a props. conf that filters out unwanted files.

Show Suggested Answer

Suggested Answer: B

When dealing with a directory containing a mix of file types, it's essential to fine-tune the sourcetypes for different files to ensure accurate data parsing and indexing.

B . On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza: This is the correct answer. In this approach, the Universal Forwarder is set up with a directory monitor where the sourcetype is initially left as automatic. Then, a props.conf file is configured to specify different sourcetypes based on the source (filename or path). This ensures that as the data is collected, it is appropriately categorized by sourcetype according to the file type.

Splunk Documentation Reference:

Configuring Inputs and Sourcetypes

Fine-tuning sourcetypes

by Rima at Apr 30, 2025, 02:11 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Amber

1 months ago

Wait, are we sure these options are mutually exclusive? Can't we just use a combination of them for maximum flexibility?

upvoted 0 times

Gail

10 days ago

C) On the Indexer parsing the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props.conf that filters out unwanted files.

upvoted 0 times

...

Carla

11 days ago

B) On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.

upvoted 0 times

...

Jamey

13 days ago

A) On the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.

upvoted 0 times

...

Erinn

1 months ago

Option D just sounds like more work than it's worth. Why complicate things on the forwarder when you can do it all on the indexer?

upvoted 0 times

...

Portia

2 months ago

Hmm, Option C with multiple sourcetype_source attributes sounds interesting, but it might get a bit messy. I'd prefer to keep it straightforward.

upvoted 0 times

Mattie

30 days ago

B) On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.

upvoted 0 times

...

Glenn

1 months ago

A) On the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.

upvoted 0 times

...

Cristy

2 months ago

I like the simplicity of Option B. Leaving it automatic on the forwarder and then configuring props.conf on the indexer side sounds efficient.

upvoted 0 times

Douglass

22 days ago

Yuonne: Definitely, keeping it automatic on the forwarder and setting up props.conf on the indexer side is a smart approach.

upvoted 0 times

...

Yuonne

26 days ago

User 2: Yeah, it's a simple solution that can be easily implemented.

upvoted 0 times

...

Mammie

1 months ago

User 1: I agree, Option B seems like the most efficient choice.

upvoted 0 times

...

Margurite

2 months ago

That's a good point, I see the rationale behind option C now. It could help filter out unwanted files effectively.

upvoted 0 times

...

Jennie

2 months ago

But wouldn't setting multiple sourcetype_source attributes on the Indexer be more efficient, like in option C?

upvoted 0 times

...

Margurite

2 months ago

I disagree, I believe the correct answer is B. We should leave sourcetype as automatic on the forwarder.

upvoted 0 times

...

Tegan

2 months ago

Option A seems like the way to go. Keeping the sourcetype automatic on the indexer and then using props.conf to assign specific sourcetypes is a clean approach.

upvoted 0 times