Which of the following files is used for both search-time and index-time configuration?
A.
inputs.conf
B.
props.conf
C.
macros.conf
D.
savesearch.conf
The Answer Is:
B
This question includes an explanation.
Explanation:
The props.conf file is a crucial configuration file in Splunk that is used for both search-time and index-time configurations.
At index-time, props.conf is used to define how data should be parsed and indexed, such as timestamp recognition, line breaking, and data transformations.
At search-time, props.conf is used to configure how data should be searched and interpreted, such as field extractions, lookups, and sourcetypes.
B. props.conf is the correct answer because it is the only file listed that serves both index-time and search-time purposes.
Splunk Documentation References:
props.conf - configuration for search-time and index-time
SPLK-1005 PDF/Engine
Printable Format
Value of Money
100% Pass Assurance
Verified Answers
Researched by Industry Experts
Based on Real Exams Scenarios
100% Real Questions
Get 60% Discount on All Products,
Use Coupon: "8w52ceb345"