Tune Props.conf SPLK-2002 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A team ingests logs where the timestamp is not at the beginning but appears after a variable-length prefix, such as 'host=web01 [2024-05-01 12:00:00] message'. The default timestamp extraction is slow because Splunk searches the entire event. They want to optimize timestamp extraction. Which setting should they configure?

   • ATIME_FORMAT = %b %d %H:%M:%S
   • BSHOULD_LINEMERGE = false
   • CMAX_TIMESTAMP_LOOKAHEAD = 0
   • DTIME_PREFIX = \[ and TIME_FORMAT = %Y-%m-%d %H:%M:%S
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What does the INDEX_EXTRACTIONS setting control in props.conf?

   • AThe number of fields that can be extracted per event.
   • BThe maximum size of an event that can be indexed.
   • CThe format of the timestamp used for indexing.
   • DWhether field extractions are performed at index time or search time.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An admin has made several props.conf changes to improve performance, including changes to LINE_BREAKER, TIME_PREFIX, and SEGMENTATION. After deploying to a test indexer, they notice that some events are missing or have incorrect timestamps. They want to identify which change is causing the issue without affecting production. What is the best approach?

   • ARevert all changes and apply them one by one, testing after each.
   • BUse the Preview tool in the Add Data flow to test each change individually on a sample of data.
   • CUse 'btool' to compare the configuration before and after the changes.
   • DCheck the indexer's metrics to see if indexing performance has changed.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the function of the BREAK_ONLY_BEFORE setting in props.conf?

   • AIt specifies the format of the timestamp at the beginning of each event.
   • BIt defines the maximum number of events to break per second.
   • CIt specifies a regular expression that must match the beginning of a new event.
   • DIt determines the character encoding of the input data.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company ingests logs from multiple sources where the timestamp format varies. Some logs have timestamps in the format '2024-05-01 12:00:00', others have 'May 1 12:00:00', and some have epoch timestamps. The team wants to optimize timestamp extraction for all formats without sacrificing performance. What is the best approach?

   • AUse a single sourcetype with a regex in TIME_PREFIX to match all formats.
   • BUse a transforms.conf rule to normalize all timestamps to a common format before indexing.
   • CCreate separate sourcetypes for each timestamp format and configure TIME_FORMAT for each.
   • DSet MAX_TIMESTAMP_LOOKAHEAD to a very high value to ensure all timestamps are found.
   Reveal Solution Discussion Select an answer first