Thanks for the reply.
But - I did input my data through Add data process, and I entered my values in the advanced section. The data is in Splunk (just one static log so I didn't monitor it, just uploaded), and when I go to my Source Types, and I open my custom made source (it was made under Category - Custom and App - Search & Reporting), I can see under advanced my BREAK_ONLY_BEFORE, TIME_FORMAT, TIME_PREFIX and other values. But I still don't have props.conf in my etc/system/local folder. There is inputs.conf, migration.conf, README and server.conf.
And now that I've typed all that, I went under "Distribute source type configurations in Splunk Enterprise" and found this line:
For example, if you selected the "Search and Reporting" app, the file resides in $SPLUNK_HOME/etc/apps/search/local/props.conf
This explains everything, the App you save stuff in determines where the file goes... Thanks again for the quick response.
... View more