I have a forwarder sending some log files to an indexer. I have configured the inputs.conf file on the forwarder to create a new sourcetype from these logs. The forwarder correctly sends the data with the correct sourcetype but I need to adjust how linebreaking behaves.
I know I could modify props.conf on the forwarder to solve this, but in this case I would like to do it through Data Preview. However, so far I have only found a way to use this feature with data residing on the server and not from files coming from forwarders. Is it possible to use Data Preview on data coming from a forwarder?
