Splunk Exam SPLK-1005 Topic 12 Question 14 Discussion

The props.conf file is a crucial configuration file in Splunk that is used for both search-time and index-time configurations.

At index-time, props.conf is used to define how data should be parsed and indexed, such as timestamp recognition, line breaking, and data transformations.

At search-time, props.conf is used to configure how data should be searched and interpreted, such as field extractions, lookups, and sourcetypes.

B . props.conf is the correct answer because it is the only file listed that serves both index-time and search-time purposes.

Splunk Documentation Reference:

props.conf - configuration for search-time and index-time