Exam SPLK-1005 topic 1 question 21 discussion

Evaluating Each Option: A. Splunk annotates data with only 3 metadata keys: host, source, and sourcetype.** ❌ * This happens during the **parsing or indexing phase**, not the input phase. B. Splunk sets the character encoding of the data.** ✅ * This is a **core function** of the input phase. C. Splunk looks at the contents of the data to apply the correct source.** ❌ * Splunk doesn't infer source from content; the **source** is generally assigned from the input path or connection. D. Splunk breaks data into individual lines.** ❌ * This happens in the **parsing phase**, where event boundaries are determined.

B is the correct answer

B is the correct option. As per Splunk Cloud Administration manual, slide 279 "During the input phase, Splunk sets all input data to UTF-8 encoding..."

B according to slide 279 by Splunk Cloud Admin