Splunk ES indexer deployment

[brianmarc]

I see some apps that state they need to be deployed to indexers. However I see no usage of the “TRANSFORMS-” in the props.conf for the app. Is this an error in the README file or an error in my assessment of index-time field extractions?

[LukeMurphey]

"TRANSFORMS-" is not the only indication of index-time knowledge. You also need to consider:

• CHARSET
• TRUNCATE
• LINE_BREAKER
• LINE_BREAKER_LOOKBEHIND
• SHOULD_LINEMERGE
  • BREAK_ONLY_BEFORE_DATE
  • BREAK_ONLY_BEFORE
  • MUST_BREAK_AFTER
  • MUST_NOT_BREAK_AFTER
  • MUST_NOT_BREAK_BEFORE
  • MAX_EVENTS
• DATETIME_CONFIG
• TIME_PREFIX
• MAX_TIMESTAMP_LOOKAHEAD
• TIME_FORMAT
• TZ
• MAX_DAYS_AGO
• MAX_DAYS_HENCE
• MAX_DIFF_SECS_AGO
• MAX_DIFF_SECS_HENCE