Should a props.conf even exist on universal forwarders? Is all that work (including timestamp and line-breaking) done at the indexer?
There are instances where you would have a props.conf on the UF but not for line breaking and timestamping. These tasks are done on the Indexer.
One use case is for MSSQL logs because they are in a different UTF format so you would need to have a props.conf on the UF to let the UF know what format the data is in .
There are instances where you would have a props.conf on the UF but not for line breaking and timestamping. These tasks are done on the Indexer.
One use case is for MSSQL logs because they are in a different UTF format so you would need to have a props.conf on the UF to let the UF know what format the data is in .
Good resource here
You can set things like the sourcetype in props.conf at the input stage - which is all the UF does (the input stage)