I am using universal forwarders to move log data from remote servers to a centralized Splunk Light server. Where do I edit the props.config? On the remote server or on the centralized Splunk Light server? When I search for props.config, I am returned server files, which one should I choose? I am a surprised that Splunk doesn't automatically break these into events because my log file has a blank space between each event.
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: Hourly...
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: Successfully....
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: File created...
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: People Counter...
MessageType: INFO | ApplicationName: MicroSaleDataTransporter | ApplicationVersion: 1.3.0.0 | Message: Successfully...
Thanks,
Chris
↧