Hello,
I created a new sourcetype and there is no props.conf in splunk/etc/system/local..
Where is it stored? or is it a different .conf for the "Set sourcetype" function??
Thank you
What app were you in when you created the new sourcetype? It may be in the props.conf file for that app (/opt/splunk/etc/apps/*/local).
What app were you in when you created the new sourcetype? It may be in the props.conf file for that app (/opt/splunk/etc/apps/*/local).