Hi All,
Is it necessary to add props.conf at indexer when we want to break the file using BREAK_ONLY_BEFORE and MUST_BREAK_AFT
You should ALWAYS have base configs (props.conf) for each sourcetype. LINEBREAKER
is almost always a better choice than BREAK_ONLY_BEFORE
.
Base configs will do two things for you. It will ensure your events are broken up properly and make sure the timestamp is correct. Your base configs should include the 6 following attributes
[sourcetype]
LINEBREAKER
SHOULD_LINEMERGE
MAX_TIMESTAMP_LOOKAHEAD
TIME_PREFIX
TIME_FORMAT
TRUNCATE
To add to this, The sourcetype definition (props.conf, transforms.conf if needed) should be configured on the first full Splunk Enterprise instance in the data flow from source, so in most cases it's indexer, in some cases, it's heavy forwarder.