SPLK-1003 · Question #17
Within props. conf, which stanzas are valid for data modification? (select all that apply)
The correct answer is A. Host C. Source D. Sourcetype. In props.conf, stanzas identify the data source to which transformations apply. The three valid stanza types for data modification are: Host (A) - matches based on the host field value; Source (C) - matches based on the source field value (e.g., a file path); and Sourcetype (D)…
Question
Within props. conf, which stanzas are valid for data modification? (select all that apply)
Options
- AHost
- BServer
- CSource
- DSourcetype
How the community answered
(47 responses)- A94% (44)
- B6% (3)
Explanation
In props.conf, stanzas identify the data source to which transformations apply. The three valid stanza types for data modification are: Host (A) - matches based on the host field value; Source (C) - matches based on the source field value (e.g., a file path); and Sourcetype (D) - matches based on the sourcetype assigned to events. 'Server' (B) is not a valid stanza type in props.conf. Sourcetype stanzas are the most commonly used for applying field extractions, transforms, and other data modifications.
Topics
Community Discussion
No community discussion yet for this question.