I am trying to create a props.conf to pass a custom timestamp. To do so I wanted to upload data and use the set source type page to configure timestamp parameters and then copy the props.conf to clipboard.
However, the preview on this page does not update when I click "Apply Settings". The preview only changes when I select a new source type from the dropdown next to "Save As", changing anything in "Event Breaks", "Timestamp", or "Advanced" does nothing.
Some thing to note is there is a red exclamation point in the top left saying "Can only preview uploaded files", unsure what this means.
When I do save the data and search it, it DOES look like the source type changes I made took effect, but this really isn't a feasible way to test and configure my parameters. Any way to get this visible in "Add Data"s preview?
I have the same issue and believe it is caused from the last cloud update. I have note reported this as a bug yet.
Hi
this should works https://community.splunk.com/t5/Getting-Data-In/What-props-conf-and-transforms-conf-settings-I-need-...
r. Ismo