I was just poking around to find out why my data had this strange sourcetype
history-y2016-m06-d-10, and when I went to
C:\Program Files\SplunkUniversalForwarder\etc\apps\learned\local, I found a props.conf and sourcetypes.conf. It's like it has been recording what I have it reading from inputs.conf? What are these files generated for?
This is the learned app, it is unique to each instance, and dynamically populated.
Where splunk store automatic sourcetypes (for each file that was monitored without specifying a sourcetype)
see the very last remark of this page :
If we have too many sourcetypes, say around in 1600 in props.conf, does it affects the indexing & search performance ? If yes, it would be great if you could help me understand the logic behind it .
Thanks in Advance !!