Getting Data In

Does a universal forwarder ever read props.conf?

a212830
Champion

Hi,

Does a UFW ever read a props.conf file? Is there any reason to put a props.conf on a UFW system?

gbronner_rbc
Explorer

It appears that you need to edit the props.conf file on the forwarder if you want to have non-default handling of structured (e.g. CSV files).

In particular, I was trying to have a CSV file override the timestamp field to read it from one of my fields -- I needed to tell the fowarder that it was a custom type:

Forwarder:

[myType]
INDEXED_EXTRACTIONS = csv

And on the indexer:

[myType]
INDEXED_EXTRACTIONS = csv
TIMESTAMP_FIELDS = foo

If only the second one was set, the events did not parse correctly.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

cphair
Builder

See http://wiki.splunk.com/Community:HowIndexingWorks for a summary of which settings take effect at which locations.

Runals
Motivator

? That is not how I understand the process to happen or even what I read from what you linked. A UF has no concept of what an event is. However you can set things like the host and sourcetype fields and what index data goes to. You can't do things like control linebreaking, timestamp definition, etc which are set in props.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...