Hi,
I have splunk enterprise running on my system and forwarder and deployer are on same machine, I need to configure line breaker for events for few of the log files, to send one event per log file without breaking any log file in multiple events.
I know the regex to be used:
I know that the above configuration is to be made on the props.conf, I just need to know where this props.conf has to be deployed, on the forwarder or deployer?
And whats the best practice to do that??
The props should ultimately end up on the indexer. If you are using a deployment server, It would be best to put this within an app on the deployment server and push it out to all your indexers.
Here is a good resource for future reference https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F