topic Props and the Magic 8 in Getting Data In

Props and the Magic 8

dolj — Mon, 25 Nov 2024 19:57:24 GMT

with respect to the Magic 8 should you always try to include them in the props of your various source types for a data set? I am slightly confused as if this is a best practice why most pre-configured TAs on splunkbase include the magic 3 or 4 what happened to the rest of them? Is it always a best practice to include all 8?

Re: Props and the Magic 8

richgalloway — Mon, 25 Nov 2024 20:23:06 GMT

Yes, it is considered Best Practice to specify all of the Great/Magic 8 props every time. People are lazy, however, so TAs often include only the props that differ from the default settings.

Re: Props and the Magic 8

sainag_splunk — Mon, 25 Nov 2024 20:31:11 GMT

Yes, it's recommended as a best practice to implement all Magic 8 configs because they establish consistency and reliability in data onboarding. While most TAs start with Magic 6, adding the EVENT_BREAKER configs gives you better control over event distribution and parsing. Think of Magic 6 as the minimum standard, and Magic 8 as the complete package for optimal data handling.

The TAs can be updated with the additional configs when needed based on your specific deployment, but having all 8 from the start is generally ideal as it prevents potential data parsing issues down the line.

If this Helps, Please Upvote.