Splunk Enterprise Certified Admin Practice Test

Which of the following configurations is used for delimiter-based extractions?

1. props.conf

2. transforms.conf

3. both props.conf and transforms.conf

4. neither props.conf nor transforms.conf

The correct answer is: both props.conf and transforms.conf

Delimiter-based extractions in Splunk are usually handled through configurations in both props.conf and transforms.conf. The props.conf file is used to define the characteristics of the data source, including how the data should be parsed, indexed, and extracted. For delimiter-based extractions, props.conf typically specifies the proper settings to recognize the structure of the incoming data, such as the delimiter used to separate the fields. On the other hand, transforms.conf contains the regular expressions and rules necessary to actually extract the fields from the raw data once it has been recognized by the props.conf configurations. This file allows you to define how to apply the extraction logic to the data defined in props.conf based on its specific structure. Together, these two configuration files form a robust solution for configuring delimiter-based extractions, where props.conf specifies how to recognize the kind of data being ingested and transforms.conf provides the rules for extracting the fields based on the defined delimiters. This combined approach is what makes the option of using both configurations the correct choice for handling delimiter-based extractions in Splunk.