According to Best Practices for App building , we should at minimum set:
TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, TIME_FORMAT, LINE_BREAKER, SHOULD_LINEMERGE, TRUNCATE, KV_MODE
So normally for a sourcetype, I would set these basic configurations in props.conf to help Splunk parse data during indexing. I'm wondering if this is even necessary when I'm using a Splunk DB Connect 2 or Splunk DB Connect 3 add-on to load the data. It seems that we already set these when we are creating the db input.
↧