Before we used distributed search, we used to have a stanza like this in props.conf:
[lan]
pulldown_type = true
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
TRANSFORMS = syslog-host
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
That doesn't seem to work if we put that on the search head. Do we have to put it on each of the indexers? Is the SHOULD_LINEMERGE statement only active at index time?
... View more