SPLK-1003 Exam Dumps - Splunk Enterprise Certified Admin

[Reference:https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Bypassautomaticsourcetypeassignment, , When using a directory monitor input, specific source types can be selectively overridden using props.conf. The props.conf file contains settings for parsing and indexing data, as well as search-time field extractions. The props.conf file can be used to assign or change source types for specific inputs using the sourcetype attribute. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Configure directory monitor inputs - Splunk Documentation], , ]