Summary

This whole chapter revolved around the props.conf and transforms.conf settings up until the end and was purely technical. We began by understanding the parsing phase, coming right after the input phase, and its significance. Out of the three components, the full parsing pipeline exists on the HF and the indexer, and not on the UF; however, the UF is able to parse structured files through the INDEXED_EXTRACTIONS setting. We learned that it is mandatory to deploy parsing settings on the HF if the indexers are fronted by it.

Afterward, we looked at the props.conf stanzas related to sourcetype, source, and host and went through the specification of the source type definition for line breaker, line merging, and timestamp identification. To continue, we learned about the transforms.conf stanzas that work in accordance with props.conf. We further advanced into applying the SEDCMD setting via props.conf for data masking and the transforms.conf settings for overriding the source...