Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)
Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)
Within props.conf, the valid stanzas for data modification are Host, Source, and Sourcetype. The Host stanza is used to set or override the host field for incoming data. The Source stanza is used to specify or override the source field of incoming data. The Sourcetype stanza is used to set or override the sourcetype field. Server is not a valid stanza for data modification within props.conf.
Option - A,C & D are correct.
https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Propsconf
ACD correct answer, page 151 data admin
A,C,D is the correct answer
A, C & D are correct
ACD. P206 in the new data admin pdf
ACD are the options
Data Admin pdf, pg 205. A, C, D
Host, source and source type. A, C & D are correct
A, C and D
A,C & D are correct. https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf#props.conf.spec https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Propsconf
I have used source type in my env not sure about the source. Haven't used
I would assume it is bad practice to alter the source type at different stages. Not something that often change in my experience, haha. Would stick with A, B and D. I know those can change
Nevermind. Seems you are correct. Reviewing the data admin PDF shows that data modification at least has the variables for host, source and sourcetype