Splunk Basics and Interface Navigation →hardMultiple ChoiceObjective-mapped

SPLK-1001 Splunk Basics and Interface Navigation Practice Question

Exhibit

Refer to the exhibit.
[default]
host = server1
index = main
sourcetype = syslog

This is a props.conf configuration snippet. What does it configure?

⚠ Common exam trap

Test-takers frequently confuse the `[default]` stanza in props.conf with input-level defaults set in inputs.conf, or mistakenly think it applies only to a specific sourcetype or host, when in fact it is a global fallback for event parsing attributes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Global default values for host, index, and sourcetype.

The `[default]` stanza in props.conf sets global default values for host, index, and sourcetype that apply to all data inputs unless overridden by a more specific stanza. This stanza is processed first and provides fallback values for any event that does not match a source, sourcetype, or host-specific configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Global default values for host, index, and sourcetype.
Why this is correct
The [default] stanza applies to all data that doesn't have its own stanza.
✗
Settings for the host server1.
Why it's wrong here
A [host::server1] stanza would be host-specific.
✗
Settings for the syslog sourcetype.
Why it's wrong here
A [syslog] stanza would be needed for sourcetype-specific settings.
✗
Default values for all inputs.
Why it's wrong here
While it sets defaults, it applies to all data, not just inputs. More specifically, it sets defaults for host, index, and sourcetype.

Go deeper

SPLK-1001 Splunk Basics and Interface Navigation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question