Since I'm Splunk employee, the Splunk answers community manager reached out directly to me.
It was a bug on the server side which has been corrected.
... View more
I'm unable to comment on any posts, only answer. If I click on the "comment" link, it takes me down to the big answer box.
I tried with multiple browsers as well.
... View more
hey guys, sorry for making my comment an answer. For some reason, it won't allow me to make comments, only answers.... ???
When I click on "comment" it drops down to the main answers section.
... View more
Good simple example of using a deployment server here: https://docs.splunk.com/Documentation/MSApp/1.4.3/MSInfra/Createthesendtoindexerapp
This will give you better idea of why/when you would want to use a DS
... View more
I came to same conclusion as @niketn
I tested it out and here is the props.conf that works:
[test_line_break]
DATETIME_CONFIG =
LINE_BREAKER = (]}]}]})
MAX_TIMESTAMP_LOOKAHEAD = 27
NO_BINARY_CHECK = true
TIME_PREFIX = time
category = Custom
disabled = false
pulldown_type = true
... View more