Hello,
We are helping our indexers get through a bout of too-many-sources. We've applied the short-term solution (a script to trim the number of sources), and are looking at the long-term fix to employ props/transforms changes to normalize the source names through regex. It would seem (to this relative novice) that setting the source in inputs.conf would be an easy way to limit the numbers of sources, but the inputs.conf documentation indicates that this is a Bad Idea:
NOTE: Overriding the source key is generally not recommended. Typically, the input layer will provide a more accurate string to aid in problem analysis and investigation, accurately recording the file from which the data was retreived. Please consider use of source types, tagging, and search wildcards before overriding this value.
Apologies if I'm being dim here, but could someone please explain what the pitfalls are here? If our apps are not using the source key specifically, is overriding it a viable option? I appreciate any insight you might have. Thanks.
... View more
