What is the role of HEADER_MODE in props.conf?

[brandy81]

Hi,

What is the role of HEADER_MODE in props.conf? I am seeing the documents, but I don't understant.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Propsconf

Could anyone please let me know what it is with specific example?

Thanks in advance.

[richgalloway]

See https://community.splunk.com/t5/Getting-Data-In/How-can-I-configure-and-set-metatada-of-a-dataset-us... and https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-requireHeader-to-override-indexing-sett...

[brandy81]

@richgalloway  Hi Thanks. But I have already read the links you suggested. I would like to know when HEADER_MODE is helpful. 

Isn't there anyone who could explain the specific circumstance where  the HEADER_MODE is necessary? 

[richgalloway · Accepted solution]

It's there for scripted inputs to tell Splunk about the data it is about to deliver. The input may gather data from different sources or of different types and the "***SPLUNK***" token tells Splunk what metadata to assign to the data.
See https://docs.splunk.com/Documentation/Splunk/latest/Data/Assignmetadatatoeventsdynamically

[isoutamo]

When you are feeding or reading several different events (sources, sourcetypes) and you want to tell to the splunk what those events are, instead that splunk needs to “guess” what this specific events are. Basically you could think it as “beta version of HEC”.

r. Ismo