Do we need to add props.conf at indexer if we are using BREAK_ONLY_BEFORE and MUST_BREAK_AFTER?

[nasrinmulani]

Hi All,

Is it necessary to add props.conf at indexer when we want to break the file using BREAK_ONLY_BEFORE and MUST_BREAK_AFT

[skoelpin]

You should ALWAYS have base configs (props.conf) for each sourcetype. LINEBREAKER is almost always a better choice than BREAK_ONLY_BEFORE.

Base configs will do two things for you. It will ensure your events are broken up properly and make sure the timestamp is correct. Your base configs should include the 6 following attributes

[sourcetype]
LINEBREAKER
SHOULD_LINEMERGE
MAX_TIMESTAMP_LOOKAHEAD
TIME_PREFIX 
TIME_FORMAT
TRUNCATE

[somesoni2]

To add to this, The sourcetype definition (props.conf, transforms.conf if needed) should be configured on the first full Splunk Enterprise instance in the data flow from source, so in most cases it's indexer, in some cases, it's heavy forwarder.