topic Re: How to change props.conf based on input/sourcetype in Getting Data In

How to change props.conf based on input/sourcetype

tbrown — Wed, 08 Jul 2020 13:42:38 GMT

I have a couple .txt files that I want to parse differently than the rest of my data coming in from my forwarders.

How could I change the props.conf (Or any other relevant config file) to parse through this specific sourcetype/input differently? (Ex. Turn off breaks before dates, etc.)

Additionally, would I be able to do this on a forwarder/deployment-app level, or would I have to do this all on the $SPLUNK_HOME/etc/system/local level on the main Splunk instance server.

Re: How to change props.conf based on input/sourcetype

richgalloway — Wed, 08 Jul 2020 13:59:59 GMT

Modify the inputs.conf file to have a separate stanza for those .txt files. In that stanza, put the appropriate sourcetype for the data.

Re: How to change props.conf based on input/sourcetype

tbrown — Wed, 08 Jul 2020 14:57:20 GMT

@richgalloway

I changed the sourcetype for these files in the inputs.conf. Now do I edit how these sourcetypes are parsed in props.conf or inputs.conf?

Re: How to change props.conf based on input/sourcetype

richgalloway — Wed, 08 Jul 2020 15:17:39 GMT

Sourcetype processing is controlled by props.conf files on the indexers (or HF, if you have one).