Getting Data In

Any splunk best practices for field extraction and line breaking?

restinlinux
Explorer

Hi Splunkers,

Any Best practices for field extraction and line breaking.

i want to know something like , if we all these stanzas in props nd transfroms.conf . The line Breakin nd Field extraction will take less resource and for good optimization method.

 

Labels (3)
0 Karma

jdunlea
Contributor

The link below is to a similar question with a good answer that also contains helpful links to Splunk documentation that references best practices.

This should have what you need. 

https://community.splunk.com/t5/Getting-Data-In/What-are-the-best-practices-for-defining-source-type...

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...