Getting Data In

Do we need to add props.conf at indexer if we are using BREAK_ONLY_BEFORE and MUST_BREAK_AFTER?

nasrinmulani
New Member

Hi All,

Is it necessary to add props.conf at indexer when we want to break the file using BREAK_ONLY_BEFORE and MUST_BREAK_AFT

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should ALWAYS have base configs (props.conf) for each sourcetype. LINEBREAKER is almost always a better choice than BREAK_ONLY_BEFORE.

Base configs will do two things for you. It will ensure your events are broken up properly and make sure the timestamp is correct. Your base configs should include the 6 following attributes

[sourcetype]
LINEBREAKER
SHOULD_LINEMERGE
MAX_TIMESTAMP_LOOKAHEAD
TIME_PREFIX 
TIME_FORMAT
TRUNCATE

somesoni2
Revered Legend

To add to this, The sourcetype definition (props.conf, transforms.conf if needed) should be configured on the first full Splunk Enterprise instance in the data flow from source, so in most cases it's indexer, in some cases, it's heavy forwarder.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...