https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-props-conf/m-p/61715#M12322 <P>There are instances where you would have a props.conf on the UF but not for line breaking and timestamping. These tasks are done on the Indexer. </P> <P>One use case is for MSSQL logs because they are in a different UTF format so you would need to have a props.conf on the UF to let the UF know what format the data is in . </P> Thu, 14 Mar 2013 19:27:16 GMT tgow 2013-03-14T19:27:16Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-props-conf/m-p/61714#M12321 <P>Should a props.conf even exist on universal forwarders? Is all that work (including timestamp and line-breaking) done at the indexer? </P> Thu, 14 Mar 2013 18:45:42 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-props-conf/m-p/61714#M12321 a212830 2013-03-14T18:45:42Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-props-conf/m-p/61715#M12322 <P>There are instances where you would have a props.conf on the UF but not for line breaking and timestamping. These tasks are done on the Indexer. </P> <P>One use case is for MSSQL logs because they are in a different UTF format so you would need to have a props.conf on the UF to let the UF know what format the data is in . </P> Thu, 14 Mar 2013 19:27:16 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-props-conf/m-p/61715#M12322 tgow 2013-03-14T19:27:16Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-props-conf/m-p/61716#M12323 <P>Good resource <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">here</A></P> <P>You can set things like the sourcetype in props.conf at the input stage - which is all the UF does (the input stage)</P> Thu, 14 Mar 2013 20:56:32 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-props-conf/m-p/61716#M12323 jonuwz 2013-03-14T20:56:32Z