3 CORRECT OPTIONS: A + C + D
"Stanzas in PROPS.CONF
All data modifications in props.conf are based on either SOURCE, SOURCETYPES or HOST.
You can use wildcards (*) and regex in the source:: and host:: stanzas" <-- pg 253 Data Admin
A,C & D are correct.
https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf#props.conf.spec
https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Propsconf
I would assume it is bad practice to alter the source type at different stages. Not something that often change in my experience, haha. Would stick with A, B and D. I know those can change
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Praf7
Highly Voted 4 years, 5 months agohappy_and_lucky
4 years, 3 months agosargeholik
Highly Voted 4 years, 4 months agoliviafarris
Most Recent 3 months, 2 weeks ago65aab2c
6 months, 2 weeks agogatundu_
7 months, 1 week agogatundu_
1 year, 3 months agobobixaka
1 year, 5 months agoMando22
2 years, 7 months agodenominator
2 years, 10 months agoApis
3 years, 3 months agoloky0
3 years, 8 months agogsplunker
4 years, 2 months agoSandy_1988
4 years, 4 months agoPraf7
4 years, 5 months agoToanbego
4 years, 5 months agoToanbego
4 years, 5 months ago