Splunk Core Certified Consultant — Question 41

In what scenarios would transforms.conf be used?

Answer options

• A. Per-Event Index Routing, Applying Event Types, SEDCMD operations
• B. Per-Event Sourcetype, Per-Event Host Name, Per-Event Index Routing
• C. Per-Event Host Name, Per-Event Index Routing, SEDCMD operations
• D. Per-Event Sourcetype, Per-Event Index Routing, Applying Event Types

Correct answer: B

Explanation

The correct answer, B, highlights the use of transforms.conf for defining sourcetypes, host names, and routing information on an event level, which is essential for accurate data categorization. Options A, C, and D include elements that are either not related to transforms.conf or do not correctly represent its primary functions.