Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Where to edit props.config for breaking log into m...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am using universal forwarders to move log data from remote servers to a centralized Splunk Light server. Where do I edit the props.config? On the remote server or on the centralized Splunk Light server? When I search for props.config, I am returned server files, which one should I choose? I am a surprised that Splunk doesn't automatically break these into events because my log file has a blank space between each event.
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: Hourly...
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: Successfully....
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: File created...
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: People Counter...
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: Successfully...
Thanks,
Chris
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Edit the props.conf file wherever event parsing is done. This is usually your indexer, but could also be a heavy forwarder.
You probably have several different props.conf files. The one to edit is the one in the app the corresponds to the data you are indexing. Be sure to edit local/props.conf (create it if you need to) rather than default/props.conf.
Splunk expects events to be separated by line-end characters (\n on Linux, \r\n on Windows) and to have a timestamp. It's best, however, not to allow Splunk to make guesses about the format of your events. Instead, use props.conf to describe your data. At the very least, include the TIME_PREFIX, TIME_FORMAT, LINE_BREAKER, SHOULD_LINEMERGE, TRUNCATE, and MAX_TIMESTAMP_LOOKAHEAD attributes.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi itdept,
Description by richgalloway is very details and will work, it should be something like this basing on your data.
[sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=Regex
TIME_FORMAT=%H:%M:%S.%3N
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=12
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Edit the props.conf file wherever event parsing is done. This is usually your indexer, but could also be a heavy forwarder.
You probably have several different props.conf files. The one to edit is the one in the app the corresponds to the data you are indexing. Be sure to edit local/props.conf (create it if you need to) rather than default/props.conf.
Splunk expects events to be separated by line-end characters (\n on Linux, \r\n on Windows) and to have a timestamp. It's best, however, not to allow Splunk to make guesses about the format of your events. Instead, use props.conf to describe your data. At the very least, include the TIME_PREFIX, TIME_FORMAT, LINE_BREAKER, SHOULD_LINEMERGE, TRUNCATE, and MAX_TIMESTAMP_LOOKAHEAD attributes.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you! I created the props.conf file on the indexer and it is working. I am still not exactly sure how this fowarder creates a SourceType name but I am finally getting my logs broken correctly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The sourcetype is specified in the forwarder's inputs.conf file.
If this reply helps you, Karma would be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
