Splunk Enterprise Certified Admin Practice Test

True or False: props.conf and transforms.conf are used to store Field Extractions, Lookups, Saved searches, and Macros.

1. True

2. False

The correct answer is: False

The statement is false because props.conf and transforms.conf are specifically focused on the configuration of data parsing, field extractions, and data transformation processes within Splunk. Props.conf is used to define how Splunk should handle incoming data. This includes data parsing instructions, specifying how to extract fields from the data at index time, and determining how timestamps should be managed. It plays a crucial role in defining metadata about events, such as source types and line-breaking rules. Transfoms.conf is used to define rules for data transformation, which can include tasks such as field extractions at search time, lookups, and rewriting events. While these two configuration files are essential for extracting and managing fields, they do not directly store lookups, saved searches, or macros. Lookups are defined in lookup tables, saved searches are configured in savedsearches.conf, and macros are defined in macros.conf. Therefore, the assertion that props.conf and transforms.conf store field extractions, lookups, saved searches, and macros is incorrect, making the answer false.