I have a single sourcetype that has large log files. I don't want to change the global MAX_EVENT limit, but instead, change the single sourcetype MAX_EVENT limit to a larger number.
Is this possible within the props.conf?
yes you can certainly do that within local
folder within the same app.
1) go to app etc>apps>appname>local>props.conf
2) set MAX_EVENT for that sourcetype
you would find global MAX_EVENT limit set in default
folder just do the same in local
folder with appropriate value.
[your_sourcetype]
MAX_EVENTS = <integer>
Thank you so much! Will do!