Getting Data In

Do we need to add props.conf at indexer if we are using BREAK_ONLY_BEFORE and MUST_BREAK_AFTER?

nasrinmulani
New Member

Hi All,

Is it necessary to add props.conf at indexer when we want to break the file using BREAK_ONLY_BEFORE and MUST_BREAK_AFT

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should ALWAYS have base configs (props.conf) for each sourcetype. LINEBREAKER is almost always a better choice than BREAK_ONLY_BEFORE.

Base configs will do two things for you. It will ensure your events are broken up properly and make sure the timestamp is correct. Your base configs should include the 6 following attributes

[sourcetype]
LINEBREAKER
SHOULD_LINEMERGE
MAX_TIMESTAMP_LOOKAHEAD
TIME_PREFIX 
TIME_FORMAT
TRUNCATE

somesoni2
Revered Legend

To add to this, The sourcetype definition (props.conf, transforms.conf if needed) should be configured on the first full Splunk Enterprise instance in the data flow from source, so in most cases it's indexer, in some cases, it's heavy forwarder.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...