Module 9: Fine-tuning Inputs

Question 1

What is props.conf used for?

Answer 1

• Props.conf is a config file that is reference through all phases of Splunk: inputs, parsing and searching
• See props.conf.spec and props.conf.examples
• Used for fine tuning inputs

Question 2

What is character encoding?

Answer 2

• During the input phase, Splunk sets all input data to utf-8 encoding by default
• This can be overridden if needed by setting the CHARSET attribute

Question 3

How can directory monitor sourcetypes be fine tuned?

Answer 3

• When you add a directory monitor and specify a sourcetype explicitly, it applies to all files in the directory and subdirectors
• You can omit the sourcetype attribute
o Splunk tries to use automatic pre-trained rules
• You can then selectively override the sourcetype with props.conf