Getting Data In

universal forwarder props.conf?

a212830
Champion

Should a props.conf even exist on universal forwarders? Is all that work (including timestamp and line-breaking) done at the indexer?

0 Karma
1 Solution

tgow
Splunk Employee
Splunk Employee

There are instances where you would have a props.conf on the UF but not for line breaking and timestamping. These tasks are done on the Indexer.

One use case is for MSSQL logs because they are in a different UTF format so you would need to have a props.conf on the UF to let the UF know what format the data is in .

View solution in original post

tgow
Splunk Employee
Splunk Employee

There are instances where you would have a props.conf on the UF but not for line breaking and timestamping. These tasks are done on the Indexer.

One use case is for MSSQL logs because they are in a different UTF format so you would need to have a props.conf on the UF to let the UF know what format the data is in .

jonuwz
Influencer

Good resource here

You can set things like the sourcetype in props.conf at the input stage - which is all the UF does (the input stage)

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...