Tune Props.conf SPLK-2002 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of the SEGMENTATION setting in props.conf?

   • AIt specifies the maximum number of events to index per second.
   • BIt controls how Splunk breaks event text into searchable segments.
   • CIt determines which fields are extracted at index time.
   • DIt sets the compression level for indexed data.
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   An admin has tuned props.conf for a custom sourcetype and deployed the changes to a heavy forwarder. After deployment, they notice that events are being indexed with incorrect timestamps. The admin wants to verify whether the issue is with the props.conf configuration or something else. Which step should they take first?

   • ACheck the indexer's props.conf to ensure the same settings are applied.
   • BUse 'btool' to check the effective props.conf configuration on the heavy forwarder.
   • CRestart the heavy forwarder to ensure the configuration is loaded.
   • DUse the Preview tool in the Add Data flow to test the configuration.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which props.conf setting limits the maximum number of bytes that Splunk reads for a single event?

   • AMAX_TIMESTAMP_LOOKAHEAD
   • BTRUNCATE
   • CSHOULD_LINEMERGE
   • DLINE_BREAKER
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of the MAX_TIMESTAMP_LOOKAHEAD setting in props.conf?

   • AIt limits the number of bytes Splunk searches for a timestamp within an event.
   • BIt sets the maximum age of events that can be indexed.
   • CIt controls how many events are processed per second.
   • DIt defines the format of the timestamp in the event.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An admin is tuning event breaking for a sourcetype that has very large events (up to 1 MB). The default LINE_BREAKER is causing the indexer to consume excessive memory and CPU. The team wants to reduce resource usage while maintaining correct event boundaries. What should they consider?

   • ASet SHOULD_LINEMERGE = false to reduce processing.
   • BIncrease TRUNCATE to ensure the entire event is indexed.
   • CUse BREAK_ONLY_BEFORE instead of LINE_BREAKER to reduce memory usage.
   • DUse a transforms.conf rule to split the events before indexing.
   Reveal Solution Discussion Select an answer first