Splunk Core Certified Advanced Power User — Question 13

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list `"-debug. What will the output be?

Answer options

• A. A list of all the configurations on-disk that Splunk contains.
• B. A verbose list of all configurations as they were when splunkd started.
• C. A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
• D. A list of the current running props.conf configurations along with a file path from which the configuration was made.

Correct answer: C

Explanation

The correct answer is C because running the command after an update without restarting Splunk retrieves the on-disk configurations, including their file paths. Option A is incorrect as it lists all configurations, not just props.conf. Option B is wrong because it refers to the state of configurations at the time of splunkd's startup, not the current on-disk settings. Option D is also incorrect since it suggests retrieving the current running configurations rather than those stored on-disk.