Which of the following files is used for both search-time and index-time configuration?

The props.conf file is fundamental to Splunk's data processing pipeline and is unique among the options as it controls both index-time and search-time operations. At index-time, it dictates how raw data is parsed into events, managing settings like line breaking (LINEBREAKER), timestamp extraction (TIMEFORMAT), and character set encoding (CHARSET). At search-time, it enriches the data by defining field extractions (EXTRACT-), automatic lookups (LOOKUP-), and calculated fields (EVAL-). This dual role makes it a critical file for shaping how data is both indexed and interpreted during searches.

A. inputs.conf: This file is used almost exclusively for index-time configurations to specify data sources and initial metadata like sourcetype and index.

C. macros.conf: This file defines reusable search macros, which are expanded into SPL strings and are therefore exclusively a search-time configuration.

D. savesearch.conf: This file stores saved searches, reports, and alerts. These are all objects that are executed at search-time.

---

1. Splunk Enterprise Documentation, props.conf: The introductory section of the props.conf specification file explicitly states its dual purpose: "Use this file to set up or override data input settings, such as sourcetype, character set encoding, time stamp recognition, and event line-breaking rules. You can also use this file to configure search-time field extractions..." This document then details numerous attributes, classifying them for index-time or search-time use.

Source: Splunk Enterprise Documentation, props.conf specification file. See the "File contents" section.

2. Splunk Enterprise Documentation, Getting Data In Manual: This manual describes the data pipeline. In the section "Configure event processing," it details how props.conf is used during the parsing phase (index-time) to handle line breaking and timestamp recognition.

Source: Splunk Enterprise Documentation, Getting Data In, "Configure event processing," Section: "The parsing phase".

3. Splunk Enterprise Documentation, Knowledge Manager Manual: This manual explains how to create and manage knowledge objects. In the chapter on field extractions, it details how to configure search-time field extractions using EXTRACT and REPORT stanzas within props.conf.

Source: Splunk Enterprise Documentation, Knowledge Manager Manual, "Create and maintain search-time field extractions through configuration files," Section: "Use props.conf to create a search-time field extraction".