topic Re: Splunk ES indexer deployment in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-indexer-deployment/m-p/52246#M133 <P>"TRANSFORMS-" is not the only indication of index-time knowledge. You also need to consider:</P> <UL> <LI>CHARSET</LI> <LI>TRUNCATE</LI> <LI>LINE_BREAKER</LI> <LI>LINE_BREAKER_LOOKBEHIND</LI> <LI>SHOULD_LINEMERGE <UL> <LI>BREAK_ONLY_BEFORE_DATE</LI> <LI>BREAK_ONLY_BEFORE</LI> <LI>MUST_BREAK_AFTER</LI> <LI>MUST_NOT_BREAK_AFTER</LI> <LI>MUST_NOT_BREAK_BEFORE</LI> <LI>MAX_EVENTS</LI> </UL></LI> <LI>DATETIME_CONFIG</LI> <LI>TIME_PREFIX</LI> <LI>MAX_TIMESTAMP_LOOKAHEAD</LI> <LI>TIME_FORMAT</LI> <LI>TZ</LI> <LI>MAX_DAYS_AGO</LI> <LI>MAX_DAYS_HENCE</LI> <LI>MAX_DIFF_SECS_AGO</LI> <LI>MAX_DIFF_SECS_HENCE</LI> </UL> Tue, 15 May 2012 18:44:54 GMT LukeMurphey 2012-05-15T18:44:54Z Splunk ES indexer deployment https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-indexer-deployment/m-p/52245#M132 <P>I see some apps that state they need to be deployed to indexers. However I see no usage of the “TRANSFORMS-<NAME>” in the props.conf for the app. Is this an error in the README file or an error in my assessment of index-time field extractions?</NAME></P> Tue, 15 May 2012 18:12:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-indexer-deployment/m-p/52245#M132 brianmarc 2012-05-15T18:12:29Z Re: Splunk ES indexer deployment https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-indexer-deployment/m-p/52246#M133 <P>"TRANSFORMS-" is not the only indication of index-time knowledge. You also need to consider:</P> <UL> <LI>CHARSET</LI> <LI>TRUNCATE</LI> <LI>LINE_BREAKER</LI> <LI>LINE_BREAKER_LOOKBEHIND</LI> <LI>SHOULD_LINEMERGE <UL> <LI>BREAK_ONLY_BEFORE_DATE</LI> <LI>BREAK_ONLY_BEFORE</LI> <LI>MUST_BREAK_AFTER</LI> <LI>MUST_NOT_BREAK_AFTER</LI> <LI>MUST_NOT_BREAK_BEFORE</LI> <LI>MAX_EVENTS</LI> </UL></LI> <LI>DATETIME_CONFIG</LI> <LI>TIME_PREFIX</LI> <LI>MAX_TIMESTAMP_LOOKAHEAD</LI> <LI>TIME_FORMAT</LI> <LI>TZ</LI> <LI>MAX_DAYS_AGO</LI> <LI>MAX_DAYS_HENCE</LI> <LI>MAX_DIFF_SECS_AGO</LI> <LI>MAX_DIFF_SECS_HENCE</LI> </UL> Tue, 15 May 2012 18:44:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-indexer-deployment/m-p/52246#M133 LukeMurphey 2012-05-15T18:44:54Z