Splunk Core Certified Consultant — Question 7
Which of the following takes place during the input phase?
Answer options
- A. Splunk annotates data with only 3 metadata keys: host, source, and sourcetype.
- B. Splunk sets the character encoding of the data.
- C. Splunk looks at the contents of the data to apply the correct source.
- D. Splunk breaks data into individual lines.
Correct answer: B
Explanation
The correct answer is B because during the input phase, Splunk identifies the character encoding to ensure proper data interpretation. Option A is incorrect as it refers to metadata keys but does not describe the input phase accurately. Option C is not correct since it pertains to source assignment, which occurs after input. Option D is also wrong because breaking data into lines happens during parsing, not the input phase.