Splunk
SPLK-1003 · Question #99
What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?
The correct answer is A. host=server1. -etc/system/local/ has better precedence at index time -for identical settings in the same file, the last one overwrite others.
Splunk Indexing
Question
What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?
Exhibit
Options
- Ahost=server1
- Bhost=server1
- Chost=searchsvr1
- Dhost=unixsvr1
How the community answered
(25 responses)- A92% (23)
- B4% (1)
- C4% (1)
Explanation
-etc/system/local/ has better precedence at index time -for identical settings in the same file, the last one overwrite others.
Topics
#Host field#Metadata assignment#inputs.conf#Index time processing
Community Discussion
No community discussion yet for this question.