Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)
Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)
Within props.conf, the valid stanzas for data modification are Host, Source, and Sourcetype. The Host stanza is used to set or override the host field for incoming data. The Source stanza is used to specify or override the source field of incoming data. The Sourcetype stanza is used to set or override the sourcetype field. Server is not a valid stanza for data modification within props.conf.
Option - A,C & D are correct.
https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Propsconf
ACD correct answer, page 151 data admin
A,C,D is the correct answer
ACD are the options
ACD. P206 in the new data admin pdf
A, C & D are correct
Data Admin pdf, pg 205. A, C, D
I have used source type in my env not sure about the source. Haven't used
I would assume it is bad practice to alter the source type at different stages. Not something that often change in my experience, haha. Would stick with A, B and D. I know those can change
Nevermind. Seems you are correct. Reviewing the data admin PDF shows that data modification at least has the variables for host, source and sourcetype
A,C & D are correct. https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf#props.conf.spec https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Propsconf
A, C and D
Host, source and source type. A, C & D are correct