Splunk Enterprise

What are the props.conf standard settings for DB Connect inputs?

rsannala
Engager

Hello Experts,

 

We have splunk DB connect inputs configured to fetch logs from DB tables based on SQL queries.

In general for unstructured data we will apply below standard props.conf settings as a best practice.

TIME_FORMAT
MAX_TIMESTAMP_LOOKAHEAD
SHOULD_LINEMERGE

LINE_BREAKER
TRUNCATE

TIME_PREFIX

do we need to configure above settings for DB connect logs as well ? if yes what will be the suggested values.

Please help me to understand this.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Usually you set a needed parameters when you are defining DB inputs (with GUI). So no needs to add those separately.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Usually you set a needed parameters when you are defining DB inputs (with GUI). So no needs to add those separately.

r. Ismo

0 Karma

rsannala
Engager

Thank you for confirming

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...