Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)
A . props.conf
B . inputs.conf
C . rawdata.conf
D . transforms.conf

View Answer

Answer: AD

Explanation:

https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge/Configureadvancedextractionswithfieldtransforms

use transformations with props.conf and transforms.conf to:

C Mask or delete raw data as it is being indexed COverride sourcetype or host based upon event values

C Route events to specific indexes based on event content

C Prevent unwanted events from being indexed

Explanation:

Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Configuretimestamprecognition