In our environment,
We have Universal forwarder, Indexers and search head.
We have different approximate 20-22 splunk apps for different kind of configurations.
All apps are configured In Universal Forwarders at '/opt/splunkforwarder/etc/apps/'
No Apps are configured in indexers.
For each applications, props.conf are configured separately.
Some threads are saying "time stamping" and "line breaking" should be configured in indexers only not in UF.
Where should I place the props.conf in indexer for "time stamping" and "line breaking" for each splunk apps. ?