Splunk Enterprise Certified Admin Practice Test

True or False: You can override the sourcetype set in inputs.conf from props.conf.

1. True

2. False

3. Depends on the context

4. Can only override for certain data types

The correct answer is: False

In Splunk, the sourcetype is primarily defined in the inputs.conf file for data ingestion. It sets the default sourcetype for any incoming data. However, the sourcetype can also be manipulated within the props.conf file. Specifically, the props.conf file allows you to define or override sourcetype assignments based on indexing-time, event-time, or search-time configurations. While you cannot override a sourcetype directly in props.conf for data that has already been assigned one by inputs.conf, implementations can indeed modify sourcetype configurations based on specified conditions, such as host, source, or other attributes. Nevertheless, the default sourcetype setting established in inputs.conf cannot be directly overridden by props.conf. Therefore, the statement is false, as props.conf configurations do not allow for direct overwrites of sourcetype settings prescribed in inputs.conf after the data has already been ingested.