Cisco IOS

Getting Data In

Have recently been administrating our Splunk deployments. My question is in the CISCO TA app our props.conf has [source::*:514] stanza is this meant to say any input from 514 go to Transforms.conf for parsing?

I am trying to trace back the stanza in the Props.conf to a actual input sourcetype, as my inputs.conf is not giving me much info to TCP/UDP 514.

TIA

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

If you are designing a Splunk forwarding architecture, it can be tempting to place a Universal Forwarder (UF) ...

Data Management Digest – August 2026

Data Management Digest Welcome to the August 2026 edition of Data Management Digest! August was a big month ...

Cisco IOS

props.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026

Join the Conversation

Cisco IOS

props.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026