Which of the following is a valid stanza in props. conf?

Which of the following is a valid stanza in props. conf?

A. [sourcetype::linux_secure]

B. [host=nyc25]

C. [host::nyc*]

D. [host:nyc*]

View Answer

Answer: A

Explanation:

In props.conf, valid stanzas can include source types, hosts, and source specifications. The correct syntax uses colons for specific types, such as source types and hosts, but follows a particular format: A. [sourcetype::linux_secure] is the correct answer. This is a valid stanza format for a source type in props.conf. It indicates that the following configurations apply specifically to the linux_secure source type.

B. [host=nyc25]: Incorrect, the correct format for a host-based stanza uses double colons, not an equal sign.

C. [host::nyc]:* Incorrect, wildcards are not used in this manner within props.conf.

D. [host

]:* Incorrect, the correct format requires double colons for host stanzas.

Splunk Documentation

Reference: props.conf Specification