Splunk Core Certified Consultant — Question 13

When monitoring directories that contain mixed file types, which setting should be omitted from inputs.conf and instead be overridden in props.conf?

Answer options

• A. sourcetype
• B. host
• C. source
• D. index

Correct answer: A

Explanation

The sourcetype is typically defined in props.conf to allow for more granular control over how different file types are processed. In contrast, host, source, and index are usually set in inputs.conf and do not require modification based on file type variations.