Splunk Enterprise Security

Splunk ES indexer deployment

brianmarc
New Member

I see some apps that state they need to be deployed to indexers. However I see no usage of the “TRANSFORMS-” in the props.conf for the app. Is this an error in the README file or an error in my assessment of index-time field extractions?

0 Karma

LukeMurphey
Champion

"TRANSFORMS-" is not the only indication of index-time knowledge. You also need to consider:

  • CHARSET
  • TRUNCATE
  • LINE_BREAKER
  • LINE_BREAKER_LOOKBEHIND
  • SHOULD_LINEMERGE
    • BREAK_ONLY_BEFORE_DATE
    • BREAK_ONLY_BEFORE
    • MUST_BREAK_AFTER
    • MUST_NOT_BREAK_AFTER
    • MUST_NOT_BREAK_BEFORE
    • MAX_EVENTS
  • DATETIME_CONFIG
  • TIME_PREFIX
  • MAX_TIMESTAMP_LOOKAHEAD
  • TIME_FORMAT
  • TZ
  • MAX_DAYS_AGO
  • MAX_DAYS_HENCE
  • MAX_DIFF_SECS_AGO
  • MAX_DIFF_SECS_HENCE
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!