https://community.splunk.com/t5/Getting-Data-In/Using-Data-Preview-on-data-received-by-forwarders/m-p/21500#M3200 <P>I don't think so.</P> Thu, 01 Aug 2013 11:06:46 GMT martin_mueller 2013-08-01T11:06:46Z https://community.splunk.com/t5/Getting-Data-In/Using-Data-Preview-on-data-received-by-forwarders/m-p/21499#M3199 <P>I have a forwarder sending some log files to an indexer. I have configured the inputs.conf file on the forwarder to create a new sourcetype from these logs. The forwarder correctly sends the data with the correct sourcetype but I need to adjust how linebreaking behaves.</P> <P>I know I could modify props.conf on the forwarder to solve this, but in this case I would like to do it through Data Preview. However, so far I have only found a way to use this feature with data residing on the server and not from files coming from forwarders. Is it possible to use Data Preview on data coming from a forwarder?</P> Thu, 01 Aug 2013 09:29:16 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Data-Preview-on-data-received-by-forwarders/m-p/21499#M3199 danielpellarini 2013-08-01T09:29:16Z https://community.splunk.com/t5/Getting-Data-In/Using-Data-Preview-on-data-received-by-forwarders/m-p/21500#M3200 <P>I don't think so.</P> Thu, 01 Aug 2013 11:06:46 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Data-Preview-on-data-received-by-forwarders/m-p/21500#M3200 martin_mueller 2013-08-01T11:06:46Z