SPLK-5002 · Question #104
Which sourcetype configurations affect data ingestion? (Choose three)
The correct answer is A. Event breaking rules B. Timestamp extraction D. Line merging rules. The sourcetype in Splunk defines how incoming machine data is interpreted, structured, and stored. Proper sourcetype configurations ensure accurate event parsing, indexing, and searching. 1. Event Breaking Rules (A) Determines how Splunk splits raw logs into individual events…
Question
Which sourcetype configurations affect data ingestion? (Choose three)
Options
- AEvent breaking rules
- BTimestamp extraction
- CData retention policies
- DLine merging rules
How the community answered
(48 responses)- A71% (34)
- C29% (14)
Explanation
The sourcetype in Splunk defines how incoming machine data is interpreted, structured, and stored. Proper sourcetype configurations ensure accurate event parsing, indexing, and searching. 1. Event Breaking Rules (A) Determines how Splunk splits raw logs into individual events. If misconfigured, a single event may be broken into multiple fragments or multiple log lines may be combined incorrectly. Controlled using LINE_BREAKER and BREAK_ONLY_BEFORE settings. 2. Timestamp Extraction (B) Extracts and assigns timestamps to events during ingestion. Incorrect timestamp configuration leads to misplaced events in time-based searches. Uses TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, and TIME_FORMAT settings. 3. Line Merging Rules (D) Controls whether multiline events should be combined into a single event. Useful for logs like stack traces or multi-line syslog messages. Uses SHOULD_LINEMERGE and LINE_BREAKER settings.
Topics
Community Discussion
No community discussion yet for this question.