Most of the attributes in props.conf actually have to do with parsing events. To successfully parse events, a few questions need to be answered, such as these:
- When does a new event begin? Are events multiline? Splunk will make fairly intelligent guesses, but it is best to specify an exact setting. Attributes that help with this include:
- SHOULD_LINEMERGE = false: If you know that your events will never contain the newline character, setting this to false will eliminate a lot of processing.
- BREAK_ONLY_BEFORE = ^dddd-dd-dd: If you know that new events always start with a particular pattern, you can specify it using this attribute.
- TRUNCATE = 1024: If you are certain you only care about the first n characters of an event, ...
