https://community.splunk.com/t5/Getting-Data-In/Cisco-IOS/m-p/545014#M90888 <P>Have recently been administrating our Splunk deployments. My question is in the CISCO TA app our props.conf has [source::*:514] stanza is this meant to say any input from 514 go to Transforms.conf for parsing?</P><P>I am trying to trace back the stanza in the Props.conf to a actual input sourcetype, as my inputs.conf is not giving me much info to TCP/UDP 514.</P><P>TIA</P> Wed, 24 Mar 2021 00:11:05 GMT amack 2021-03-24T00:11:05Z https://community.splunk.com/t5/Getting-Data-In/Cisco-IOS/m-p/545014#M90888 <P>Have recently been administrating our Splunk deployments. My question is in the CISCO TA app our props.conf has [source::*:514] stanza is this meant to say any input from 514 go to Transforms.conf for parsing?</P><P>I am trying to trace back the stanza in the Props.conf to a actual input sourcetype, as my inputs.conf is not giving me much info to TCP/UDP 514.</P><P>TIA</P> Wed, 24 Mar 2021 00:11:05 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-IOS/m-p/545014#M90888 amack 2021-03-24T00:11:05Z