I have a couple .txt files that I want to parse differently than the rest of my data coming in from my forwarders.
How could I change the props.conf (Or any other relevant config file) to parse through this specific sourcetype/input differently? (Ex. Turn off breaks before dates, etc.)
Additionally, would I be able to do this on a forwarder/deployment-app level, or would I have to do this all on the $SPLUNK_HOME/etc/system/local level on the main Splunk instance server.
I changed the sourcetype for these files in the inputs.conf. Now do I edit how these sourcetypes are parsed in props.conf or inputs.conf?