universal forwarder props.conf?

[a212830]

Should a props.conf even exist on universal forwarders? Is all that work (including timestamp and line-breaking) done at the indexer?

[tgow · Accepted solution]

There are instances where you would have a props.conf on the UF but not for line breaking and timestamping. These tasks are done on the Indexer.

One use case is for MSSQL logs because they are in a different UTF format so you would need to have a props.conf on the UF to let the UF know what format the data is in .

[jonuwz]

Good resource here

You can set things like the sourcetype in props.conf at the input stage - which is all the UF does (the input stage)