Getting Data In

Will Outputs.conf reflect the timestamp parameters?

sarvesh_11
Communicator

Hello Splunkers,

I have outputs.conf in my Universal Forwarder at \etc\system\local\ , I am monitoring some log files gave the monitor path in inputs.conf.
Now just like we mention in props.conf about time stamp parameters,
Can i update the same here in Outputs.conf at SplunkUniversalForwarder\etc\system\local\ ?
Ex:
[sourcetype / source]
DATETIME_CONFIG = none
SHOULD_LINEMERGE = true.
Will i be able to get data cooked with these parameters?

Thanks in advance.
Keep Splunkning 🙂

0 Karma

skoelpin
SplunkTrust
SplunkTrust

No.. outputs.conf will only tell the forwarder where to send the data

You should also look into moving it away from etc/system/local and put it in an app instead. Reason being, if you ever had to scale the number of servers with a UF installed, you would need to use the deployment server which drops files in $SPLUNK_HOME/etc/apps/<APP-NAME>. If you have it in etc/system/local then those outputs will override what you sent via the deployment server

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...