Splunk Enterprise Certified Admin Practice Test

True or False: You can specify multiple sources in a single stanza in props.conf.

1. True

2. False

3. Only if using wildcards

4. Only for event types

The correct answer is: False

In the context of Splunk's configuration files, a stanza in props.conf is used to define properties for a specific data source, such as how data is processed and indexed. Each stanza is typically designated by a specific source type or data source, which allows for tailored configurations. When defining properties in props.conf, each stanza corresponds to a single source or source type. Therefore, you cannot specify multiple sources within a single stanza. Each source that requires distinct settings must have its own stanza. This ensures clarity and avoids potential conflicts in configurations, as different data sources may require different processing rules or settings. While the use of wildcards allows you to define stanzas that can match multiple sources based on naming patterns, this does not mean that multiple, distinct sources are specified within a single stanza—wildcards only simplify the process of addressing multiple sources by grouping them under a single general rule or schema. As for event types, while they can be configured within props.conf and may relate to how data is categorized or handled, they still must be properly set up within their respective stanzas, which would generally be specific to one type of source. Thus, the assertion that you can specify multiple sources within a single stanza is false. Each source or source type must