Configuration Files

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Which configuration file is used to define index-time field extractions and line-breaking rules?

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Where is the global configuration for Splunk Enterprise stored?

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

How does Splunk handle configuration files that are missing a required attribute?

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Which file is responsible for defining how data is rotated in an index?

Which stanza is required in props.conf to identify a sourcetype?

In props.conf, what does the 'REPORT-' prefix signify?

What happens if you have a syntax error in a .conf file?

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

When using btool, what does the output show by default?

Which command is used to restart the Splunk service after modifying configuration files?

Which TWO of the following are valid ways to define field extractions?

Which THREE of the following are true regarding the behavior of 'btool'?

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Which TWO of the following are true about 'local' versus 'default' directories?

Which TWO attributes in props.conf are commonly used to handle multiline events?

Which THREE of the following are true regarding the configuration precedence of apps?

Which TWO of the following are valid stanza types found in indexes.conf?

Which THREE of the following represent true statements about the 'transforms.conf' file?

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?