Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)
props.conf
inputs.conf
rawdata.conf
transforms.conf
https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge/Configureadvancedextractionswithfieldtransforms
use transformations with props.conf and transforms.conf to:
– Mask or delete raw data as it is being indexed
–Override sourcetype or host based upon event values
– Route events to specific indexes based on event content
– Prevent unwanted events from being indexed
Submit