The answer is B.
A new source stanza needs to be created as it is not there by default, therefore, it cannot be A.
sourcetype = <string>
* Can only be set for a [source::...] stanza.
* Anything from that <source> is assigned the specified source type.
Source:
https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf#Sourcetype_configuration:~:text=sourcetype%20%3D%20%3Cstring%3E%0A*%20Can%20only%20be%20set%20for%20a%20%5Bsource%3A%3A...%5D%20stanza.
n props.conf, using a source stanza (e.g., [source::...]) allows you to change the sourcetype based on the source path. This works because the source is often one of the first pieces of metadata used by Splunk to assign a sourcetype in inputs.conf, and you can adjust the sourcetype later in props.conf.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Betoemihtevas
1 week, 3 days agoAhsan90
3 weeks, 6 days ago