topic Re: Should props.conf match inputs.conf? in Getting Data In

Should props.conf match inputs.conf?

amulay26 — Tue, 24 Apr 2018 15:15:31 GMT

Does the props.conf file of an indexer has the same contents as the inputs.conf file of the forwarder from which it is receiving the data?

Re: Should props.conf match inputs.conf?

richgalloway — Tue, 24 Apr 2018 15:31:50 GMT

If by "have the same contents" you mean props.conf is an exact copy of inputs.conf the answer is NO.
The props.conf file on an indexer should have a stanza corresponding to each sourcetype referenced by the forwarder's inputs.conf file.

Re: Should props.conf match inputs.conf?

ddrillic — Tue, 24 Apr 2018 20:35:18 GMT

@amulay26, a good example for what @richgalloway said at How to configure inputs.conf and props.conf to monitor multiple CSV files in a directory and recognize timestamp in 2nd column?

Re: Should props.conf match inputs.conf?

amulay26 — Tue, 24 Apr 2018 20:47:00 GMT

Thank you very much @richgalloway and @ddrillic.