<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How can I define props.conf with respective source types? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-define-props-conf-with-respective-source-types/m-p/276241#M52978</link>
    <description>&lt;P&gt;Thanks sundareshr&lt;/P&gt;</description>
    <pubDate>Fri, 28 Oct 2016 21:29:42 GMT</pubDate>
    <dc:creator>sravankaripe</dc:creator>
    <dc:date>2016-10-28T21:29:42Z</dc:date>
    <item>
      <title>How can I define props.conf with respective source types?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-define-props-conf-with-respective-source-types/m-p/276239#M52976</link>
      <description>&lt;P&gt;i have text file with some data below. how can i define my props.conf file with respective sourcetypes?&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;file 1 of sourcetype=s1&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Batch Counter   Cache Name  CacheSize   MemoryBytes MemoryMB    Avg Object Size
77  Item.1.BUSINESS_PARTNER 1836304.0   1836304.0   1.7512359619140625  1.0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;props.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[s1]
TIME_FORMAT=
TIME_PREFIX=
MAX_TIMESTAMP_LOOKAHEAD=
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=
CHARSET=
category=Custom
disabled=false
pulldown_type=true
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;STRONG&gt;file 2 of sourcetype=s2&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Batch Counter   Report Time Service Cache Name  Tier    Total Puts  Total PutsMillis    Total Gets  Total Gets Millis   Total Hits  Total Hits Millis   Total Misses    Total Misses Millis Total Writes    Total Write Millis  Total Reads Total Read Millis   Total Failures  Total Queue Evictions   Cache Prunes    Cache Prunes Millis
77  Wed Oct 26 16:00:19 CDT 2016    ItemDistributedCache    Item.1.BUSINESS_PARTNER back    0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;props.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[s2]
TIME_FORMAT=
TIME_PREFIX=
MAX_TIMESTAMP_LOOKAHEAD=
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=
CHARSET=
category=Custom
disabled=false
pulldown_type=true
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;STRONG&gt;file 3 of sourcetype=s3&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Batch Counter   ReportTime  RefreshPolicy   RefreshTime RefreshExcessCount  RefreshCount    RefreshPredictionCount  RefreshTimeoutCount
77  Wed Oct 26 16:00:33 CDT 2016    refresh-ahead   Wed  Oct  26  16:00:33  CDT  2016   2351    186539  8104896     13591
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;props.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[s3]
TIME_FORMAT=
TIME_PREFIX=
MAX_TIMESTAMP_LOOKAHEAD=
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=
CHARSET=
category=Custom
disabled=false
pulldown_type=true
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;STRONG&gt;file 4 of sourcetype=s4&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Batch Counter   Report Time JVM Uptime  Node Id GC Name CollectionCount Delta Collection Count  CollectionTime  Delta Collection Time   Last GC Start Time  Last GC Duration Millis Heap Committed  Heap Init   Heap Max    Heap Used

77  Wed Oct 26 16:00:19 CDT 2016    51754933    1   Garbage collection optimized for deterministic pausetimes Old Collector 140 0.0 498984  0.0 41146021    1565.0  6442450944  4294967296  6442450944  3854384608
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;props.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[s4]
TIME_FORMAT=
TIME_PREFIX=
MAX_TIMESTAMP_LOOKAHEAD=
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=
CHARSET=
category=Custom
disabled=false
pulldown_type=true
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 28 Oct 2016 20:28:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-define-props-conf-with-respective-source-types/m-p/276239#M52976</guid>
      <dc:creator>sravankaripe</dc:creator>
      <dc:date>2016-10-28T20:28:42Z</dc:date>
    </item>
    <item>
      <title>Re: How can I define props.conf with respective source types?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-define-props-conf-with-respective-source-types/m-p/276240#M52977</link>
      <description>&lt;P&gt;All your source appear to be &lt;CODE&gt;tab separated values&lt;/CODE&gt; as such, you should be able to use &lt;CODE&gt;tsv&lt;/CODE&gt; as the predefined sourcetype.&lt;/P&gt;

&lt;P&gt;OR use these settings to create individual sourcetype for each file. All source will have the same settings&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[ s1]
CHARSET=AUTO
FIELD_DELIMITER=tab
HEADER_FIELD_DELIMITER=tab
INDEXED_EXTRACTIONS=tsv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
description=Tab-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 28 Oct 2016 21:23:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-define-props-conf-with-respective-source-types/m-p/276240#M52977</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-10-28T21:23:32Z</dc:date>
    </item>
    <item>
      <title>Re: How can I define props.conf with respective source types?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-define-props-conf-with-respective-source-types/m-p/276241#M52978</link>
      <description>&lt;P&gt;Thanks sundareshr&lt;/P&gt;</description>
      <pubDate>Fri, 28 Oct 2016 21:29:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-define-props-conf-with-respective-source-types/m-p/276241#M52978</guid>
      <dc:creator>sravankaripe</dc:creator>
      <dc:date>2016-10-28T21:29:42Z</dc:date>
    </item>
  </channel>
</rss>

