exam questions

Exam SPLK-1005 All Questions

View all questions & answers for the SPLK-1005 exam

Exam SPLK-1005 topic 1 question 1 discussion

Actual exam question from Splunk's SPLK-1005
Question #: 1
Topic #: 1
[All SPLK-1005 Questions]

When monitoring directories that contain mixed file types, which setting should be omitted from inputs.conf and instead be overridden in props.conf?

  • A. sourcetype
  • B. host
  • C. source
  • D. index
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
cagdaskarabag
2 weeks, 1 day ago
Selected Answer: A
When monitoring directories that contain mixed file types, the sourcetype setting should be omitted from inputs.conf and instead overridden in props.conf. This is because props.conf is specifically designed for advanced data parsing and classification, including overriding or configuring the source type for incoming data. By defining sourcetype in props.conf, you can apply more granular rules or dynamic recognition based on the characteristics of the data being ingested. This approach avoids conflicts and ensures proper handling of mixed file types
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago