SPLK-1002 · Question #63
This is what Splunk uses to categorize the data that is being indexed.
The correct answer is B. Sourcetype. Splunk uses the sourcetype field to categorize the type and format of data being indexed.
Question
This is what Splunk uses to categorize the data that is being indexed.
Options
- AHost
- BSourcetype
- CIndex
- DSource
How the community answered
(31 responses)- A3% (1)
- B90% (28)
- C6% (2)
Why each option
Splunk uses the sourcetype field to categorize the type and format of data being indexed.
Host identifies the originating machine or device that sent the data and does not describe the format or category of the data.
Sourcetype is the key metadata field that tells Splunk how to interpret and parse the structure of incoming data, enabling correct field extraction and event formatting during indexing for any given data source.
Index is a storage partition for indexed data and is not a classification mechanism for data format or type.
Source refers to the file path or input from which data was collected, not the format or type of the data itself.
Concept tested: Splunk sourcetype metadata field for data categorization
Source: https://docs.splunk.com/Documentation/Splunk/latest/Data/Whatsourcetype
Topics
Community Discussion
No community discussion yet for this question.