Where is my props for a certain sourcetype?

[danielbb]

Since we are in early stages of using Splunk cloud, we don't define props.conf as part of the onboarding process, and we introduce props for a certain sourcetype only when parsing goes off. So for a certain sourcetype, line-breaking is off, and when looking for the sourcetype on the indexers (via support) and on the on-prem HF where the data is ingested and I cannot find the props for this sourcetype. So I wonder is it possible to have no sourcetype anywhere for a particular source?

[PickleRick]

1. The best practice is to define as much as you can from the so-called magic eight. It boosts performance on ingestion and lets you avoid errors with line breaking or timestamp recognition.

2. Sourcetype is just a value of metadata associated with an event. From technical point of view it doesn't have to be "defined" anywhere prior to setting given value as sourcetype. You could even create an index-time transform setting a sourcetype to a completely random value and Splunk would still work and process the events (although the effects might be far from desirable). It's the other way around - the value of the sourcetype metadata can - if configured properly - affect how Splunk processes events. BTW, sourcetype is just one of the metadata fields that comes into play when Splunk decides what to do with an event. Other ones are source and host.