Splunk Core Certified Advanced Power User — Question 156

A sourcetype has been explicitly set in inputs.conf. How can the sourcetype be fine-tuned in props.conf during the Input phase?

Answer options

• A. By using the source stanza value in props.conf.
• B. By overriding it using the sourcetype value in a new source stanza.
• C. The sourcetype value cannot be changed in props.conf.
• D. By adding the new sourcetype, followed by a comma, after the old sourcetype in a new stanza of props.conf.

Correct answer: B

Explanation

The correct answer is B, as it allows for the sourcetype to be specifically overridden in a new source stanza in props.conf. Option A is incorrect because it refers to using the source stanza, which does not allow for fine-tuning the sourcetype. Option C is wrong since the sourcetype can indeed be changed in props.conf. Option D is also incorrect, as it misrepresents the method of defining a new sourcetype by suggesting an incorrect format.