Splunk Enterprise Certified Admin Practice Test

Which configuration file on the Search Head defines what data to collect, including Splunk logs?

1. outputs.conf

2. runs.conf

3. props.conf

4. inputs.conf

The correct answer is: inputs.conf

The configuration file that defines what data to collect, including Splunk logs, is inputs.conf. This file is crucial in the Splunk architecture as it specifies the data sources that Splunk should monitor. Within inputs.conf, you can configure various data inputs, including files, directories, network streams, and more. By doing so, you instruct Splunk on what data to ingest, ensuring that the relevant information is available for indexing and searching. In contrast, outputs.conf is mainly used for defining how to forward data to other Splunk instances, which is not directly related to data collection. Props.conf is used to configure attribute settings for data that has already been indexed, determining how Splunk should treat the data during indexing and search. Runs.conf is not a standard file related to data inputs in Splunk, and its function is more associated with configurations that manage search functionality rather than data input settings. Therefore, inputs.conf is the correct answer as it specifically addresses the configuration of data collection in Splunk.