A consultant is working with a data source that includes a timestamp in the event text, but Splunk is not recognizing it correctly. The consultant has verified that the timestamp format is not in Splunk's default list. Which configuration change should be made to ensure Splunk extracts the timestamp correctly?

Change the source type to a predefined one that matches the format

Use a search-time extraction to override the timestamp

Add a TIMESTAMP_EXTRACT setting in transforms.conf

Add a TIME_FORMAT setting in props.conf for the source type

A consultant is troubleshooting an issue where events are being indexed with the correct timestamp but the source type is incorrectly detected. The data is a mix of JSON and plain text logs from the same input. The consultant has already verified that the input is configured correctly. Which configuration change would ensure the correct source type is assigned to each event?

Use props.conf to define a source type that matches both formats

Enable source type detection in the input stage

Set a fixed source type in inputs.conf for the entire input

Use a transforms.conf rule with a regex to set the source type based on the event content

SplunkCore Certified Consultant

Domain 5Objective 2

Describe Event Processing and Data Pipelines CORE-CERTIFIED-CONSULTANT Practice Questions (Page 5)

Part of the Indexing domain, which accounts for 14% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

14%of the exam

Questions 21–22

21application · medium
A consultant is working with a data source that includes a timestamp in the event text, but Splunk is not recognizing it correctly. The consultant has verified that the timestamp format is not in Splunk's default list. Which configuration change should be made to ensure Splunk extracts the timestamp correctly?
Select an answer first
22expert · hard
A consultant is troubleshooting an issue where events are being indexed with the correct timestamp but the source type is incorrectly detected. The data is a mix of JSON and plain text logs from the same input. The consultant has already verified that the input is configured correctly. Which configuration change would ensure the correct source type is assigned to each event?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Describe Event Processing and Data Pipelines CORE-CERTIFIED-CONSULTANT Practice Questions (Page 5)

Questions 21–22

Keep studying — Indexing