Getting Data In

Will Outputs.conf reflect the timestamp parameters?

sarvesh_11
Communicator

Hello Splunkers,

I have outputs.conf in my Universal Forwarder at \etc\system\local\ , I am monitoring some log files gave the monitor path in inputs.conf.
Now just like we mention in props.conf about time stamp parameters,
Can i update the same here in Outputs.conf at SplunkUniversalForwarder\etc\system\local\ ?
Ex:
[sourcetype / source]
DATETIME_CONFIG = none
SHOULD_LINEMERGE = true.
Will i be able to get data cooked with these parameters?

Thanks in advance.
Keep Splunkning 🙂

0 Karma

skoelpin
SplunkTrust
SplunkTrust

No.. outputs.conf will only tell the forwarder where to send the data

You should also look into moving it away from etc/system/local and put it in an app instead. Reason being, if you ever had to scale the number of servers with a UF installed, you would need to use the deployment server which drops files in $SPLUNK_HOME/etc/apps/<APP-NAME>. If you have it in etc/system/local then those outputs will override what you sent via the deployment server

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...