When using a directory monitor input, specific source types can be selectively overridden using which configuration file?

The correct answer is D. props . conf. props.conf is the Splunk configuration file used to define and override source type settings, including selectively assigning sourcetypes based on source path patterns. When monitoring a directory with multiple file types, you can use props.conf stanzas (keyed on source path…

Configuration Files

Question

Options

Asourcetypes . conf
Btrans forms . conf
Coutputs . conf
Dprops . conf

How the community answered

(64 responses)

A
3% (2)
B
8% (5)
C
2% (1)
D
88% (56)

Explanation

props.conf is the Splunk configuration file used to define and override source type settings, including selectively assigning sourcetypes based on source path patterns. When monitoring a directory with multiple file types, you can use props.conf stanzas (keyed on source path patterns like [source::.../path/...])) to override the default sourcetype for specific files or subdirectories. transforms.conf handles field extraction and routing rules (used in conjunction with props.conf). outputs.conf controls forwarding destinations. 'sourcetypes.conf' does not exist as a Splunk configuration file - sourcetype configuration lives in props.conf.

Topics

#Data Inputs#Sourcetype Overriding#Configuration Files#Props.conf

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice