Splunk Core Certified Advanced Power User — Question 59

Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)

Answer options

• A. Host
• B. Server
• C. Source
• D. Sourcetype

Correct answer: C, D

Explanation

The correct answers are C and D because the 'Source' and 'Sourcetype' stanzas are specifically designed for data transformation in Splunk. The 'Host' and 'Server' stanzas do not pertain to data modification, as they are primarily used for specifying the origin and the server configurations respectively.