3 CORRECT OPTIONS: A + C + D
"Stanzas in PROPS.CONF
All data modifications in props.conf are based on either SOURCE, SOURCETYPES or HOST.
You can use wildcards (*) and regex in the source:: and host:: stanzas" <-- pg 253 Data Admin
A,C & D are correct.
https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf#props.conf.spec
https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Propsconf
I would assume it is bad practice to alter the source type at different stages. Not something that often change in my experience, haha. Would stick with A, B and D. I know those can change
Nevermind. Seems you are correct. Reviewing the data admin PDF shows that data modification at least has the variables for host, source and sourcetype
upvoted 3 times
...
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Praf7
Highly Voted 4 years, 2 months agohappy_and_lucky
4 years agosargeholik
Highly Voted 4 years, 1 month agoliviafarris
Most Recent 1 week, 6 days ago65aab2c
3 months, 1 week agogatundu_
4 months agogatundu_
1 year agobobixaka
1 year, 2 months agoMando22
2 years, 3 months agodenominator
2 years, 7 months agoApis
3 years agoloky0
3 years, 5 months agogsplunker
3 years, 11 months agoSandy_1988
4 years, 1 month agoPraf7
4 years, 2 months agoToanbego
4 years, 2 months agoToanbego
4 years, 2 months ago