When monitoring directories that contain mixed file types, the sourcetype setting should be omitted from inputs.conf and instead overridden in props.conf. This is because props.conf is specifically designed for advanced data parsing and classification, including overriding or configuring the source type for incoming data. By defining sourcetype in props.conf, you can apply more granular rules or dynamic recognition based on the characteristics of the data being ingested. This approach avoids conflicts and ensures proper handling of mixed file types
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
cagdaskarabag
2 weeks, 1 day ago