Splunk Core Certified Advanced Power User — Question 149

What is an example of a proper configuration for CHARSET within props.conf?

Answer options

• A. [source::/var/log/splunk] CHARSET = BIG5
• B. [sourcetype::json] CHARSET = BIG5
• C. [host::server.splunk.com] CHARSET = BIG5
• D. [index::main] CHARSET = BIG5

Correct answer: A

Explanation

Option A is correct because it specifies the CHARSET configuration for a specific source, which is the correct usage in props.conf. The other options incorrectly apply CHARSET to sourcetype, host, and index, which are not valid contexts for CHARSET configuration.