According to Splunk's documentation for props.conf, the ANNOTATE_PUNCT setting "Determines whether to index a special token starting with "punct::" ".
Does this setting get applied at input-time or index-time?
That's index-time.
See http://wiki.splunk.com/Community:HowIndexingWorks - happens in the annotator
processor within the typingQueue
.
That's index-time.
See http://wiki.splunk.com/Community:HowIndexingWorks - happens in the annotator
processor within the typingQueue
.