Getting Data In

Any splunk best practices for field extraction and line breaking?

restinlinux
Explorer

Hi Splunkers,

Any Best practices for field extraction and line breaking.

i want to know something like , if we all these stanzas in props nd transfroms.conf . The line Breakin nd Field extraction will take less resource and for good optimization method.

 

Labels (3)
0 Karma

jdunlea
Contributor

The link below is to a similar question with a good answer that also contains helpful links to Splunk documentation that references best practices.

This should have what you need. 

https://community.splunk.com/t5/Getting-Data-In/What-are-the-best-practices-for-defining-source-type...

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...