without the props the files are read and each line in each file is an event.
With the props.conf most of the files are one event.
I was hoping to manage this at index time on the intermediate forwarder and not have to manage props.conf on the indexers and universal forwarder.
I will start with the indexers, as the UF does not seem like a likely place to put props.conf, and see if this helps
Thanks much for the suggestion @jkat45. I was hoping to avoid dispersed management of props.conf
... View more