Hi Splunkers,
Any Best practices for field extraction and line breaking.
i want to know something like , if we all these stanzas in props nd transfroms.conf . The line Breakin nd Field extraction will take less resource and for good optimization method.
The link below is to a similar question with a good answer that also contains helpful links to Splunk documentation that references best practices.
This should have what you need.