Splunk SPLK-1005 Exam - Topic 5 Question 4 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 4
Topic #: 5

When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

Atransforms.conf

Bprops.conf

Cinputs.conf

Doutputs.cont

Show Suggested Answer

Suggested Answer: B

When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.

Splunk Documentation Reference: props.conf configuration

by Nickolas at Oct 23, 2024, 12:20 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Cheryl

3 months ago

I didn't know you could override sourcetypes like that!

upvoted 0 times

...

Timothy

3 months ago

Nope, it's not transforms.conf, it's definitely props.conf.

upvoted 0 times

...

Leanora

3 months ago

Wait, are we sure about that? I thought it might be transforms.conf.

upvoted 0 times

...

Filiberto

4 months ago

Agreed, props.conf is the way to go!

upvoted 0 times

...

Jacquelyne

4 months ago

It's definitely props.conf for overriding sourcetypes.

upvoted 0 times

...

Regenia

4 months ago

I thought inputs.conf was more about defining data inputs rather than overriding sourcetypes, but I could be mistaken.

upvoted 0 times

...

Alexia

4 months ago

I practiced a question similar to this, and I believe it's props.conf where you can specify overrides for sourcetypes.

upvoted 0 times

...

Brinda

4 months ago

I remember something about transforms.conf being related to sourcetypes, but I can't recall if it's the right one for overriding.

upvoted 0 times

...

Peggie

5 months ago

I think the file where you can override sourcetyping is props.conf, but I'm not entirely sure.

upvoted 0 times

...

Cruz

5 months ago

B, props.conf, that's the file where you can override the automatic sourcetyping.

upvoted 0 times

...

Margret

5 months ago

I'm a bit confused on this one. I'll have to review my notes to see where we covered this.

upvoted 0 times

...

Nina

5 months ago

Okay, I remember learning about this in the Splunk training. I think the answer is B, props.conf.

upvoted 0 times

...

Ellsworth

5 months ago

I'm pretty sure the answer is props.conf, but let me double-check that.

upvoted 0 times

...

Carlene

5 months ago

Hmm, this seems like a tricky one. I'll need to think it through carefully.

upvoted 0 times

...

Ernie

1 year ago

The answer is clearly B) props.conf. Unless you're a Splunk newbie, that's just common knowledge.

upvoted 0 times

...

Ria

1 year ago

B) props.conf, of course. What kind of Splunk admin doesn't know that?

upvoted 0 times

...

Marquetta

1 year ago

I don't know, but I hope the exam doesn't have any trick questions like this. It's making my head spin!

upvoted 0 times

...

Genevive

1 year ago

Definitely B) props.conf. That's where you go to customize the sourcetype settings for individual files.

upvoted 0 times

Alison

1 year ago

props.conf is definitely the file to look at for selectively overriding automatic sourcetyping.

upvoted 0 times

...

Rodrigo

1 year ago

props.conf definitely gives you the flexibility to customize sourcetype settings as needed.

upvoted 0 times

...

Crissy

1 year ago

It's so convenient to have that option in props.conf for selective overrides.

upvoted 0 times

...

Kasandra

1 year ago

I always make sure to check props.conf when I need to override automatic sourcetyping.

upvoted 0 times

...

Hermila

1 year ago

I agree, props.conf is the way to go for customizing sourcetype settings.

upvoted 0 times

...

Arminda

1 year ago

I always make sure to check props.conf when I need to override automatic sourcetyping.

upvoted 0 times

...

Starr

1 year ago

I agree, props.conf is the way to go for customizing sourcetype settings.

upvoted 0 times

...

Madelyn

1 year ago

Hmm, I was thinking C) inputs.conf, but now I'm not so sure. This question is tricky!

upvoted 0 times

Dean

1 year ago

D) outputs.conf

upvoted 0 times

...

Julian

1 year ago

C) inputs.conf

upvoted 0 times

...

Frederic

1 year ago

B) props.conf

upvoted 0 times

...

Reta

1 year ago

A) transforms.conf

upvoted 0 times

...

Yun

1 year ago

I'm pretty sure the answer is B) props.conf, since that's where you can override the sourcetype settings.

upvoted 0 times

Dortha

1 year ago

Good to know, thanks for clarifying!

upvoted 0 times

...

Margarita

1 year ago

Yes, that's correct. It allows you to customize sourcetype settings for specific files.

upvoted 0 times

...

Janine

1 year ago

I think you're right, props.conf is where you can selectively override sourcetype settings.

upvoted 0 times

...

Amina

1 year ago

I agree with Gail, inputs.conf is the correct answer for selectively overriding automatic sourcetyping.

upvoted 0 times

...

Gail

1 year ago

I think the answer is C) inputs.conf because it allows us to override automatic sourcetyping.

upvoted 0 times

...