Dashboards & Visualizations

Configure line breaker

macadminrohit
Contributor

Hi,

I have splunk enterprise running on my system and forwarder and deployer are on same machine, I need to configure line breaker for events for few of the log files, to send one event per log file without breaking any log file in multiple events.

I know the regex to be used:

I know that the above configuration is to be made on the props.conf, I just need to know where this props.conf has to be deployed, on the forwarder or deployer?

And whats the best practice to do that??

Tags (1)
0 Karma

sundareshr
Legend

The props should ultimately end up on the indexer. If you are using a deployment server, It would be best to put this within an app on the deployment server and push it out to all your indexers.

Here is a good resource for future reference https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...