Have recently been administrating our Splunk deployments. My question is in the CISCO TA app our props.conf has [source::*:514] stanza is this meant to say any input from 514 go to Transforms.conf for parsing?
I am trying to trace back the stanza in the Props.conf to a actual input sourcetype, as my inputs.conf is not giving me much info to TCP/UDP 514.
TIA
