Getting Data In

Using Data Preview on data received by forwarders

Path Finder

I have a forwarder sending some log files to an indexer. I have configured the inputs.conf file on the forwarder to create a new sourcetype from these logs. The forwarder correctly sends the data with the correct sourcetype but I need to adjust how linebreaking behaves.

I know I could modify props.conf on the forwarder to solve this, but in this case I would like to do it through Data Preview. However, so far I have only found a way to use this feature with data residing on the server and not from files coming from forwarders. Is it possible to use Data Preview on data coming from a forwarder?


I don't think so.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!