Splunk Core Certified Advanced Power User — Question 20

In which Splunk configuration is the SEDCMD used?

Answer options

• A. props.conf
• B. inputs.conf
• C. indexes.conf
• D. transforms.conf

Correct answer: A

Explanation

The SEDCMD directive is utilized in the props.conf file to perform field transformations at index time. The other configuration files, such as inputs.conf and transforms.conf, serve different purposes; inputs.conf is for defining data inputs and transforms.conf is for defining data transformation rules, but SEDCMD specifically belongs in props.conf.