Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

where to put extract statement

$
0
0

Hi,

I am processing some logs on a universal forwarder, which then sends the data to some indexers, which are searched from a search-head on a different server. I need to do an extract on the logfiles. Where should the extract statements go? In the props.conf on the receiving indexers, or the search-head?


Viewing all articles
Browse latest Browse all 13053

Trending Articles