Hello
For a particular sourcetype I am trying to to configure props.conf so that the lines should not be merged.
I have created /opt/splunkhome/apps/custom_addon/local/props.conf and set it to this:
[a_dev_logs] <-----source type
SHOULD_LINEMERGE = false
That is literally all that is in the props.conf, however even when re issuing the add on to the UF (and restarting it), and when reloading the deployment server it still does not kick in.
The source type is already used by these logs, it has been previously configured.
When I input (upload) the logs as a file on the IND and tell it to break them out it does do this, however I then cannot find the newly configured props.conf file where this configuration would be (tried /apps/search/local/ but its not there).
Any help would be appreciated, thanks! I have tried looking for a previously answered question on this but couldn't find anything that does.
↧