thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

props.conf

A Splunk configuration file that defines parsing and search-time behavior for sourcetypes, sources or hosts.

Definition

props.conf controls line breaking, timestamp extraction, character encoding, field extractions, field aliases and calculated fields, and references transforms.conf for routing, masking and complex extractions. Settings apply at index time or search time depending on the attribute.

Example

[linux_secure] TIME_FORMAT = %b %d %H:%M:%S

Exam tip

Index-time settings live on indexers or heavy forwarders; search-time extractions live on search heads.

Related terms