Getting Data In

index time props vs search time props

GeorgeStarkey
Path Finder

I am trying to find any documentation on exactly which props & transforms can be set on indexer vs search time.

I know a few must be set at index (or from forwarder) time such as host, index, source, sourcetype. however what other parts can/should.

linebreak?
timezone?

I had documented from PS in the past, however can no longer find it.

0 Karma

Ayn
Legend
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...