I've added a custom application in SPLUNK which utilizes LINE_BREAKER and SHOULD_LINEMERGE features of props.conf. The implementation works great in my development instance of SPLUNK.
I have to create this application and add line merge logic on a Splunk Cloud instance. I need your help to understand:
Does SPLUNK offer a way to update application specific props.conf file (from Splunk Web) so that I can apply LINE_BREAKER and LINEMERGE logic? If yes, Please help me with the procedure or how can I achieve this if creating a file in Filesystem and editing is the only option.
a bit late for the party ...
In Splunk Enterprise under
Settings - Source Types you can list, create and edit sourcetypes options in the according
The docs talk about the process to modify sourcetypes in Splunk Enterprise here http://docs.splunk.com/Documentation/Splunk/latest/Data/Managesourcetypes and for Splunk Cloud here http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Managesourcetypes
Hope this helps ...
Check out this post, it shows how you can use the Web UI to modify the
I hope that helps!
That link seems to have gone dead.
The link just has one extra plus sign in the end. Can't seem to add a link here, but copy+paste this: https://answers.splunk.com/answers/149597/im-struggling-with-how-i-should-be-doing-inputs-and-also-p...
I'm pretty sure you CANNOT modify your
props.conf from the UI. You will need to edit the .conf file on the indexer