Hi @ethanthomas, I think you want which props setting has an effect on the indexer. You can check the below wiki page, on this page parsing phase happens on indexers (or heavy forwarders). And as @richgalloway said, these settings are works by sourcetype not index. https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F TRUNCATE, LINE_BREAKER, SHOULD_LINEMERGE, BREAK_ONLY_BEFORE_DATE, and all other line merging settings
TZ, DATETIME_CONFIG, TIME_FORMAT, TIME_PREFIX, and all other time extraction settings and rules
TRANSFORMS* which includes per-event queue filtering, per-event index assignment, per-event routing. Applied in the order defined
SEDCMD*
MORE_THAN*, LESS_THAN*
... View more