When using a directory monitor input, specific source type can be selectively overridden using which configuration file?

The correct answer is A. props.conf. props.conf is the correct file for overriding source types on a per-source, per-host, or per-sourcetype basis. You can define stanzas using source:: or host:: patterns to selectively assign different sourcetypes to specific files being monitored within a directory, even if the mo

Configuration Files

Question

Options

Aprops.conf
Bsourcetypes.conf
Ctransforms.conf
Doutputs.conf

How the community answered

(54 responses)

A
94% (51)
B
4% (2)
D
2% (1)

Explanation

props.conf is the correct file for overriding source types on a per-source, per-host, or per-sourcetype basis. You can define stanzas using source:: or host:: patterns to selectively assign different sourcetypes to specific files being monitored within a directory, even if the monitor input assigns a default sourcetype. sourcetypes.conf (B) does not exist as a Splunk configuration file. transforms.conf (C) is used for field extractions, masking, and routing-not sourcetype assignment at the input level. outputs.conf (D) controls where data is forwarded, not how it is parsed or classified.

Topics

#sourcetype override#props.conf#data onboarding#inputs configuration

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice