n props.conf, using a source stanza (e.g., [source::...]) allows you to change the sourcetype based on the source path. This works because the source is often one of the first pieces of metadata used by Splunk to assign a sourcetype in inputs.conf, and you can adjust the sourcetype later in props.conf.
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Ahsan90
6 days, 21 hours ago