A has been explicitly set in inputs.conf. How can the be fine- sourcetype sourcetype tuned in props.conf during the Input phase?

The correct answer is C. The value cannot be changed in props.conf. When a sourcetype is explicitly assigned in inputs.conf, it is set at the point of data collection and is locked in for the input phase. Props.conf can apply transformations to data matching a sourcetype stanza, but it cannot override or reassign the sourcetype itself once it…

Configuration Files

Question

A has been explicitly set in inputs.conf. How can the be fine- sourcetype sourcetype tuned in props.conf during the Input phase?

Options

ABy using the source stanza value in props.conf.
BBy overriding it using the sourcetype value in a new source stanza.
CThe value cannot be changed in props.conf.
DBy adding the new sourcetype, followed by a comma, after the old sourcetype in a new

How the community answered

(43 responses)

A
5% (2)
C
93% (40)
D
2% (1)

Explanation

When a sourcetype is explicitly assigned in inputs.conf, it is set at the point of data collection and is locked in for the input phase. Props.conf can apply transformations to data matching a sourcetype stanza, but it cannot override or reassign the sourcetype itself once it has been explicitly defined in inputs.conf. The explicitly set value takes highest precedence during the input phase and cannot be overridden by props.conf at that stage.

Topics

#sourcetype#inputs.conf#props.conf#Data Pipeline

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice