An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user’s local context to disable the field aliases?
To disable the field aliases in the user's local context, the appropriate method is to clear the settings by changing their values to null. This effectively disables the field aliases without overwriting any existing configuration globally, which aligns with the requirement to manage configuration at the user's level. Therefore, the correct way to update the user's local props.conf file is by setting the desired FIELDALIAS entries to null, as shown in option B.
B place no content to remove from output
I would go for B. "You clear a setting by changing its value to null." Reference: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Clear%20a%20setting
Answer D looks correct. The field alias has been commented out using '#'
Why not D?
B is correct Open the outputs.conf file in your local directory. Find the forwardedindex.0.whitelist setting and change the value to null. For example: forwardedindex.0.whitelist =