Hey @solarboyz1 ,
Thanks much for your response,
My intent for asking this was,
Try to analyse 1 scenario, i have forwarder installed on a server, now in system\local\inputs.conf of that forwarder i have defined my monitoring path, index and sourcetype. Also, at system\local\props.conf, i have defined some attributes say Line Breaker, Time Stamp and rest other things, (i know its not advisable to make modification in system\local, but we need to monitor for only this particular server.)
Now when these logs are parsing to Indexer directly, lets consider, they are adapting the props.conf settings what we had mentioned at forwarder,(assuming, as i am restricted to use Indexer's UI). Now when the logs are moving from Indexer to Search Head, will they still be adapting the same setting, what it was on forwarder, or it will take the setting of default? As we have not mentioned our source type attributes on Indexer's props.conf.
... View more