Splunk Core Certified Consultant — Question 19

Which of the following files is used for both search-time and index-time configuration?

Answer options

• A. inputs.conf
• B. props.conf
• C. macros.conf
• D. savedsearch.conf

Correct answer: B

Explanation

The correct answer is B, props.conf, as it is utilized for configuring data processing for both indexing and searches. Inputs.conf is specific to data input settings, macros.conf is for defining macros, and savedsearch.conf is used for saving search configurations, which do not apply to both search-time and index-time.