Does the props.conf file of an indexer has the same contents as the inputs.conf file of the forwarder from which it is receiving the data?
If by "have the same contents" you mean props.conf is an exact copy of inputs.conf the answer is NO.
The props.conf file on an indexer should have a stanza corresponding to each sourcetype referenced by the forwarder's inputs.conf file.
If by "have the same contents" you mean props.conf is an exact copy of inputs.conf the answer is NO.
The props.conf file on an indexer should have a stanza corresponding to each sourcetype referenced by the forwarder's inputs.conf file.
@amulay26, a good example for what @richgalloway said at How to configure inputs.conf and props.conf to monitor multiple CSV files in a directory and recogni...
Thank you very much @richgalloway and @ddrillic.