Configuration Files

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Which configuration file is used to define index-time field extractions and line-breaking rules?

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

How does Splunk handle configuration files that are missing a required attribute?

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Which file is responsible for defining how data is rotated in an index?

In props.conf, what does the 'REPORT-' prefix signify?

What happens if you have a syntax error in a .conf file?

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

When using btool, what does the output show by default?

Which command is used to restart the Splunk service after modifying configuration files?

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Which TWO of the following are true about 'local' versus 'default' directories?

Which TWO of the following are valid stanza types found in indexes.conf?

Which THREE of the following represent true statements about the 'transforms.conf' file?

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

A Splunk administrator needs to ensure that events from a custom sourcetype named 'myapp:log' are timestamped using the format '%Y-%m-%d %H:%M:%S.%3N' and that the timezone is set to UTC. The sourcetype is defined in an app named 'myapp' located at $SPLUNK_HOME/etc/apps/myapp. The administrator wants this configuration to apply only to this app and not affect other apps. Which configuration file and stanza should be edited?

A Splunk administrator needs to ensure that a specific sourcetype is assigned to data coming from a particular source path. The administrator wants to define the sourcetype at the forwarder before data leaves the host. Which configuration file should be edited on the universal forwarder?

An administrator is troubleshooting why a custom field extraction defined in props.conf is not being applied to events. The extraction uses a REPORT-class stanza that references a transform in transforms.conf. After running btool props list --debug, the administrator sees the REPORT setting is active. What is the next most likely configuration issue to investigate?

A Splunk administrator is troubleshooting why a newly created sourcetype is not being assigned to incoming data from a Universal Forwarder. The administrator suspects a configuration conflict. Which command should be used to determine the effective configuration and the file that is providing the sourcetype definition?

A Splunk administrator is configuring a new index and needs to ensure that data is retained for exactly 90 days and then frozen. The administrator also wants to limit the index size to 500 GB. Which TWO settings in indexes.conf must be configured to achieve these requirements? (Choose two.)

A junior administrator wants to change the default maximum size of the internal index (_internal) to prevent it from consuming too much disk space. Which configuration file and stanza should they edit?

A Splunk administrator is configuring a new forwarder to send data to an indexer. The administrator wants to ensure that the forwarder uses a specific port and that the connection is encrypted. Which file should be edited to set the default target group and enable SSL, and what is the correct stanza name?

An administrator needs to configure a Splunk indexer to retain data for 90 days and then delete it. The administrator also wants to ensure that the index does not exceed 500 GB in size. Which configuration file and settings should be used to achieve this?

A Splunk admin needs to ensure that a custom sourcetype is recognized by all indexers in a distributed environment. The sourcetype definition exists in $SPLUNK_HOME/etc/system/local/props.conf on the search head. Indexers are not recognizing the sourcetype. What is the most likely cause?

A Splunk admin is reviewing an inputs.conf file and notices a stanza with the attribute 'disabled = 1'. What does this attribute accomplish in this context?

A Splunk admin is troubleshooting why a search returns no results for a specific index. The admin suspects a configuration precedence issue involving index definitions in multiple apps. Which TWO actions would help identify which configuration file is actually being used for the index definition? (Choose two.)

An admin needs to change the default retention period for an index without affecting other indexes. The change should persist across restarts. Which configuration file should be edited?

An administrator is deploying a new index called metrics_archive on an indexer cluster. The administrator creates the index stanza in indexes.conf and places the file in etc/system/local on the cluster manager. After the bundle is pushed, searches against metrics_archive on the peer nodes fail with an error that the index does not exist. Which is the most likely cause?